Mbed TLS

Security status for teams that ship Mbed TLS: which branches get fixes and for how long, every advisory, and the fixes a given version is missing.

Mbed TLS has 3 maintained branches, and support for 3.6 LTS ends in March 2027, less than six months away. 89 CVEs are on record and 28 were fixed in 2026 releases. None is known to be exploited (CISA KEV, 10 Nov 2026).

19 CVEs have no NVD score yet. MCUboot and U-Boot ship 3.6.0, which is missing 42 security fixes.

Data as of 11 Nov 2026, 13:24 UTCLast synced:ChangeLog 11 Nov 2026Releases 11 Nov 2026NVD 11 Nov 2026CISA KEV 11 Nov 2026Advisories 11 Nov 2026Downstream 11 Nov 2026
Maintained branches
3.6 LTS (3.6.7), 4.1 LTS (4.1.1) and 4.x (4.2.0)
CVEs on record
By year of identifier, 2011 to 2026
Fixed in 2026 releases
28Across 3.6, 4.1 and 4.2
Known exploited
0CISA KEV catalogue, 10 Nov 2026
Not yet scored by NVD
Mostly 2026. Assess them yourself.

Check a version

Pick the Mbed TLS version in your product to see the security fixes released after it on its branch, and what to move to.

Try 3.6.0 (MCUboot, U-Boot) or 3.6.6 (EDK II, OP-TEE, Trusted Firmware-A).

Support runway

How long each branch gets security fixes. A product that must be supported beyond a branch's end date cannot rely on that branch.

Branch
Supported until
Latest
4.2
next 4.x
4.2.0
4.1 LTS
Mar 2029
4.1.1
3.6 LTS
Mar 2027
3.6.7
2.28
Mar 2025
2.28.10
Dots are releases. Red is support ending within six months; hatched is a branch that no longer gets fixes. Dates from the project's BRANCHES.md and git tags.

Advisories 89

Every CVE in Mbed TLS, PolarSSL and TF-PSA-Crypto. Severity is NVD's base score; unscored means NVD has not published one yet.

51 of 89 advisories
CVE
Issue
Severity
Fixed in
CVE-2026-73096 
TLS 1.3 early data integrity failure due to buffered plaintext across key change (CVE-2026-73096)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-73064 
A random generator fault can compromise TLS data integrity (CVE-2026-73064)
Low 2.9
Not recorded
CVE-2026-54441 
Signature algorithm restrictions not enforced on certificate chain (CVE-2026-54441)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-54435 
Side channel leak in ECC optimized modp (CVE-2026-54435)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-54434 
Everest: lack of contributory behaviour due to improper input validation (CVE-2026-54434)
Unscored
4.1.1, 4.2.0
CVE-2026-50713 
Heap corruption with early renegotiation after corrupted record in DTLS (CVE-2026-50713)
Unscored
3.6.7
CVE-2026-50640 
Ignored TLS 1.3 resumption secret derivation error (CVE-2026-50640)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50588 
Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing (CVE-2026-50588)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50587 
Timing side-channel in RSA PKCS#1 v1.5 decryption (CVE-2026-50587)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50586 
Information disclosure in TLS 1.2 NewSessionTicket (CVE-2026-50586)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50585 
Incomplete context reset in mbedtls_ssl_session_reset() (CVE-2026-50585)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50584 
ChaCha20 counter overflow can reuse keystream (CVE-2026-50584)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50583 
Out-of-bounds read when parsing a zero-length ECC public key (CVE-2026-50583)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50581 
Extended master secret calculation failure ignored (CVE-2026-50581)
Unscored
3.6.7, 4.1.1, 4.2.0
CVE-2026-50580 
Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake (CVE-2026-50580)
Unscored
3.6.7, 4.1.1, 4.2.0

Who ships which Mbed TLS

Default branch of each project, checked 11 Nov 2026. Forks may carry backported fixes that a version number does not show.

Project
Mbed TLS
Missing fixes
How it is read
MCUboot main (dc46485)
3.6.0, also 4.1.0
42
Two submodules under ext/, one per supported Mbed TLS release line, each matched to an upstream tagMbed TLS 3.6.0 read from mbedtls-3.6.0 at dc46485
U-Boot master (ece349a)
3.6.0
42
Vendored copy in the source tree; the version is read from MBEDTLS_VERSION_STRING in build_info.hMbed TLS 3.6.0 read from build_info.h at ece349aLocal PKCS7 and Authenticode changes
EDK II master (dfcf216)
3.6.6
17
Submodule whose commit is matched to an upstream Mbed TLS release tagMbed TLS 3.6.6 read from mbedtls at dfcf216
OP-TEE master (23727cb)
3.6.6
17
Vendored copy in the source tree; the version is read from MBEDTLS_VERSION_STRING in build_info.hMbed TLS 3.6.6 read from build_info.h at 23727cb
Trusted Firmware-A master (20d0584)
3.6.6
17
Submodule whose commit is matched to an upstream Mbed TLS release tagMbed TLS 3.6.6 read from mbed-tls at 20d0584
ESP-IDF master (ebc4c55)
4.1.1
0
Submodule to the espressif/mbedtls fork; the version is read from MBEDTLS_VERSION_STRING in build_info.hMbed TLS 4.1.1 read from mbedtls at ebc4c55Espressif fork with driver and feature commits
Trusted Firmware-M main (af78b83)
4.2.0 (paired)
0
Depends on TF-PSA-Crypto directly (TF_PSA_CRYPTO_VERSION), the crypto release paired with an Mbed TLS releaseMbed TLS 4.2.0 (TF-PSA-Crypto 1.2.0) read from config_base.cmake at af78b83
Zephyr main (6c1bfaf)
4.1.1
0
West module revision in west.yml, with the paired TF-PSA-Crypto releaseMbed TLS 4.1.1 read from mbedtls at 6c1bfafZephyr fork with [zep noup] patches

The Cyber Resilience Act and your Mbed TLS

What the regulation expects of a manufacturer that ships Mbed TLS, and where this page answers it. A summary, not legal advice.

Report actively exploited vulnerabilities

Since 11 Sep 2026: early warning within 24 hours, through ENISA's Single Reporting Platform

None is known to be exploited: no Mbed TLS CVE is in the CISA known exploited catalogue (10 Nov 2026).

Ship without known exploitable vulnerabilities

Essential requirement, from 11 Dec 2027

Check your version above for every security fix released after it.

Handle vulnerabilities in components

Including an SBOM and a record of what you assessed

The missing-fix list for your version is the list to assess.

Security updates for the support period

At least five years, unless the product is in use for less

The support runway shows where your Mbed TLS branch runs out.

Regulation (EU) 2024/2847. Reporting dates from the European Commission's CRA reporting page. digital-strategy.ec.europa.eu 

Data sources

ChangeLogs 
Mbed TLS on archive/mbedtls-2.28, mbedtls-3.6, mbedtls-4.1 and development; TF-PSA-Crypto on main, v1.1.1 and v1.2.0 for 4.x crypto fixes. Fixed-in versions and release dates.
NVD 
API 2.0 searches for “Mbed TLS” and “PolarSSL”: scores, weaknesses and affected ranges for CVEs the ChangeLogs do not name.
CISA KEV 
Known exploited vulnerabilities catalogue 2026.11.10: no Mbed TLS or PolarSSL entry.
Security advisories 
Advisory titles and links from the mbedtls-docs repository.
Downstream repositories 
Default branches of MCUboot, U-Boot, EDK II, OP-TEE, Trusted Firmware-A, ESP-IDF, Trusted Firmware-M and Zephyr, read through the GitHub API.
Support dates 
Branch support windows and the downstream project list were last reviewed on 4 Nov 2026 (mbedtls.yaml).