CVE-2026-34873 - Vulnerability Analysis

Overview

Mbed TLS 3.5.0 through 4.0.0 contains a client impersonation vulnerability caused by improper handling of TLS 1.3 session resumption, letting attackers impersonate clients during session resumption, exploit requires resuming a TLS 1.3 session.

Severity & Score

Impact

Attackers can impersonate clients during TLS 1.3 session resumption, potentially leading to unauthorized access or data interception.

Mitigation

Update to a version later than 4.0.0 or the latest available version.

References

• https://mbed-tls.readthedocs.io/en/latest/security-advisories/
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner