Mbed TLS -- multiple vulnerabilities

2026-11-11 · CVE-2026-50581, CVE-2026-50640, CVE-2026-50580, CVE-2026-50586, CVE-2026-50588, CVE-2026-50579, CVE-2026-54441, CVE-2026-50585, CVE-2026-25832, CVE-2026-49300 · VuXML entry

Mbed TLS Team reports: CVE-2026-50581: Fix a bug where transcript-hash computation errors during TLS 1.2 extended master secret calculation could be ignored instead of causing the handshake to fail. This could allow a handshake to continue with a master secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret extension. CVE-2026-50640: Fix a …

Affected versions

• mbedtls4 < 4.2.0

By system

0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.