PT-2026-39574 · Zephyrproject Rtos · Zephyr

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-1677

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Zephyr sockets created with IPPROTO TLS 1 3 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via mbedtls ssl conf min tls version). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed IPPROTO TLS 1 3 enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses. As a workaround, the TLS CIPHERSUITE LIST socket option can be restricted to TLS 1.3-only cipher suites.

Fix

Weakness Enumeration

CWE-757

Related Identifiers

CVE-2026-1677

Affected Products

Zephyr

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-1677 · Security Note
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-23r2-m5wx-4rvq · Note