Vulnerability Description
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
CVSS Score
2.9
LOW
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Related Weaknesses (CWE)
References
- https://github.com/Mbed-TLS/mbedtls
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-a
FAQ
What is CVE-2026-73064?
CVE-2026-73064 is a vulnerability with a CVSS score of 2.9 (LOW). In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 serve...
How severe is CVE-2026-73064?
CVE-2026-73064 has been rated LOW with a CVSS base score of 2.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73064?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.