This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-73064 →
DEBIAN-CVE-2026-73064
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start...
Original description
The description as published by the source.
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
mbedtls
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
mbedtls
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
mbedtls
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1"}]}]
References
- advisory security-tracker.debian.org