PT-2026-29586 · Arm · Mbed Tls+1

Supers1Ngular · Published 2026-04-01 · Updated 2026-05-07 · CVE-2026-34871

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 3.6.6 and versions 4.0.0 through 4.1.0 TF-PSA-Crypto versions prior to 1.1.0

Description A flaw exists in the Pseudo-Random Number Generator (PRNG) due to a predictable seed. This issue impacts the generation of random numbers, potentially compromising the security of systems relying on these numbers.

Recommendations Update Mbed TLS to version 3.6.6 or later. Update Mbed TLS to version 4.1.0 or later. Update TF-PSA-Crypto to version 1.1.0 or later.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2026-34871

JLSEC-2026-465

OPENSUSE-SU-2026:10498-1

Affected Products

Mbed Tls

Tf-Psa-Crypto

References · 21

• https://osv.dev/vulnerability/JLSEC-2026-465 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34871 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34871 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-dev-random · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34871 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10498-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34871 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-34871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34871 · Security Note
• https://github.com/advisories/GHSA-rjq9-c3rf-c638 · Note
• https://suse.com/security/cve/CVE-2026-34876 · Note
• https://suse.com/security/cve/CVE-2026-34877 · Note
• https://suse.com/security/cve/CVE-2026-34874 · Note
• https://suse.com/security/cve/CVE-2026-34872 · Note