BSD PortsMbed TLS -- vulnerabilities
· CVE-2026-34873, CVE-2026-34871, CVE-2026-25835, CVE-2025-66442, CVE-2026-34874, CVE-2026-34875, CVE-2026-34872, CVE-2026-25834, CVE-2026-34876, CVE-2026-34877, CVE-2026-25833 · VuXML entry
https://mbed-tls.readthedocs.io/en/latest/security-advisories/ reports: Client impersonation while resuming a TLS 1.3 session (CVE-2026-34873) Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871) PSA random generator cloning (CVE-2026-25835) Compiler-induced constant-time violations (CVE-2025-66442) Null pointer dereference when setting a distinguished name (CVE-2026-34874) Buffer overflow in FFDH public …
Affected versions
- mbedtls3 < 3.6.6
- mbedtls4 < 4.1.0
By system
1 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/mbedtls3 | 3.6.2_1 | vulnerable since 2026-04-10 | |
| NetBSD | security/mbedtls3 | 3.6.3 | not listed | |
| MidnightBSD | security/mbedtls3 | 3.6.3_1 | in range, by version | |
| FreeBSD | security/mbedtls3 | 3.6.7 | fixed | (89 days after) |
| FreeBSD | security/mbedtls4 | 4.2.0 | fixed | (89 days after) |
| NetBSD | security/mbedtls4 | 4.0.0nb1 | not listed |