{"schema":"threatline.record/2","record":{"id":"CVE-2026-73064","aliases":[],"summary":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 serve","details":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","categories":["Unclassified"],"product":"Mbed TLS","vendor":"trustedfirmware","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73064","source_modified_at":"2026-09-24T18:00:20.196Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Mbed TLS","vendor":"trustedfirmware","versions":[{"lessThan":"3.6.7","status":"affected","version":"3.2.0","versionType":"semver"},{"lessThan":"4.1.1","status":"affected","version":"4.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73064","source_modified_at":"2026-09-24T18:00:20.196Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Mbed TLS","ecosystem":null},"version":"3.6.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73064","source_modified_at":"2026-09-24T18:00:20.196Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Mbed TLS","ecosystem":null},"version":"4.1.1","basis":"first unaffected version stated in the CVE record"}],"cvss":2.9,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00102,"percentile":0.0091,"score_date":"2026-10-23"},"published_at":"2026-09-24T14:58:38.367Z","modified_at":"2026-09-24T18:00:20.196Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-73064","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-24T18:00:20.196Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73064","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Mbed-TLS/mbedtls"},{"source":"CVE List","url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-24T18:00:13.513498Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-24T18:00:20.196Z","content_hash":"78d5798bd64880f036f501e93d97d66949c30f29609488a4cc45a231006c871c"}}