PT-2026-39574 · Mbed Tls+1 · Mbed Tls+1

Ceolin · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-1677

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description Sockets created with IPPROTO TLS 1 3 may negotiate a TLS 1.2 connection if both TLS versions are enabled in Kconfig. This occurs because the socket-level protocol selection is not propagated to mbedTLS, such as through the mbedtls ssl conf min tls version function. Consequently, the ClientHello advertises both versions, allowing a peer to establish a TLS 1.2 connection. Applications expecting IPPROTO TLS 1 3 to enforce TLS 1.3 may silently use TLS 1.2, leaving them exposed to weaknesses specific to TLS 1.2.

Recommendations Restrict the TLS CIPHERSUITE LIST socket option to TLS 1.3-only cipher suites as a temporary workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-757

Related Identifiers

CVE-2026-1677

Affected Products

Zephyr

Mbed Tls

References · 6

• 🔥 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-23r2-m5wx-4rvq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1677 · Security Note
• https://t.me/CVEtracker/53351 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053749181727006994 · Twitter Post
• https://t.me/cveNotify/162998 · Telegram Post
• https://twitter.com/CVEnew/status/2053954501640360172 · Twitter Post