coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Assemble ChangeLog

Browse Source 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
This commit is contained in:
Minos Galanakis 2026-06-26 15:33:48 +01:00
parent b767964cef
commit 71c6e06676
27 changed files with 131 additions and 156 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

131
ChangeLog
View File

@ -1,5 +1,136 @@
Mbed TLS ChangeLog (Sorted per branch, date)
= Mbed TLS 3.6.7 branch released 2026-07-07
Features
* SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
certificate profile.
Security
* Fix a side channel in RSA PKCS#1 v1.5 decryption: error handling in the
library would reveal through timing the difference between success,
invalid padding, or output too large for buffer, giving rise to a
Bleichenbacher attack. Note that while the library now handles sensitive
errors in constant-time, RSA PKCS#1 v1.5 decryption remains inherently
dangerous, should be avoided when possible, and otherwise requires great
care in application code. Found by zhengg. CVE-2026-50587
* Added advice about compiler options in SECURITY.md.
* Fix a bug where transcript-hash computation errors during TLS 1.2
extended master secret calculation could be ignored instead of causing the
handshake to fail. This could allow a handshake to continue with a master
secret that was not correctly bound to the handshake transcript,
undermining the security guarantees of the extended master secret
extension. Report by Mathew Gretton-Dann. CVE-2026-50581
* Fix a TLS 1.3 server-side error-handling bug affecting session ticket
generation. Under rare conditions, such as memory allocation failures
while computing the resumption master secret, the server could issue
invalid session tickets instead of failing the handshake. Clients
presented with such tickets would fail session resumption and fall back to
a full handshake. In deployments relying on session resumption, repeated
occurrences could increase the frequency of full handshakes and amplify
resource consumption during periods of resource exhaustion or other
transient failures. Reported by jjfz123.
CVE-2026-50640
* Fix renegotiation failing and potentially causing a buffer overflow
in DTLS when badmac_limit is enabled. Reported by Haruki Oyama.
CVE-2026-50713.
* Reject ChaCha20 operations that would make the 32-bit block counter wrap
around, which could otherwise reuse keystream and compromise
confidentiality. Reported by jiliang. CVE-2026-50584
* Fixed a TLS 1.3 record-boundary validation issue that could allow
unauthenticated plaintext data to be processed across a key change. In
servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a
man-in-the-middle attacker to cause loss of 0-RTT early data.
Reported by Ben Smyth.
CVE-2026-TODO.
* Fix a possible buffer overflow in mbedtls_ecdh_calc_secret(): when the
provided output buffer is too small, sometimes (depending on the value of
the computed shared secret), the function would not return an error as it
should, but instead write past the end of the buffer. Reported by Eva
Crystal (0xiviel) from XSource Security. CVE-2026-35336.
* Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when
CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580
* Fix a side channel in ECC computations that allows a powerful local
attacker (typically, untrusted OS attacking a secure enclave) to fully
recover long-term secret keys. Found and reported by Alejandro Cabrera
Aldaya from Tampere University. CVE-2026-54435
* Fix a potential information disclosure in TLS 1.2 servers using session
tickets. If the session ticket write callback failed without setting the
lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized
stack memory to the peer in the NewSessionTicket message. Fixes #1570.
Reported by James Love. CVE-2026-50586.
* Fix timing side channel in RSA key generation, prime generation and
primality testing, on platforms where division is not constant-time. At
this point this side channel is not known to be exploitable. Reported by
Bhargava Shastry, Ethereum Foundation.
* Fix a 1-byte buffer overread when parsing a malformed ECC public key
in the PK module. CVE-2026-50583
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange
messages. Reported-by Biniam Demissie.
CVE-2026-50588
* Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing
an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The
function now resets the context after freeing it, ensuring stale
signed_data.signers.next pointers cannot be walked by a later free
operation. CVE-2026-50579
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
SHA3-224) on signature verification. The new configuration option
MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
algorithms in PKCS7 for backward compatibility purposes.
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that
this function only sets signature algorithms that are enforced during
TLS key exchange and not on certificate verification. Reported by
Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT).
CVE-2026-54441
* Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context'
is properly zeroized when mbedtls_ssl_session_reset() is called. This
could cause incorrect DTLS-SRTP parameter inheritance for applications
reusing an SSL context.
Reported by jjfz123. CVE-2026-50585.
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return
1 instead of an error code if the random generator failed when a server
called these functions before the end of a TLS 1.3 handshake.
Reported by Mohammad Seet (mhdsait101). CVE-2026-40294
* Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was
not advertised in the original ClientHello. Reported independently by
Din Asotić / Xiangdong Li, Beijing University of Posts and
Telecommunications (BUPT), and NVIDIA Project Vanessa.
CVE-2026-25832.
* Fix two bugs in the X.509 certificate parser that caused some inputs
with a malformed basicConstraints extension to be accepted. This
could have dangerous results, in particular causing some certificates
to be parsed as CA certificates when other X.509 implementations would
parse them as end-entity certificates. Reported by Mohammad Seet
(mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300
Bugfix
* Fix a TLS 1.2 regression that caused clients to reject valid
ServerKeyExchange signatures using RSA-PSS signature algorithms.
Fixes #10668.
* Fix a problem in library/alignment.h where the Zephyr Project use
a pre-defined macro '__packed' which collides with the IAR keyword
'__packed', causing the typedefs of unaligned types to remain aligned.
Fixes mbedtls issue #10334
* Reject malformed TLS 1.3 serialized sessions instead of accepting
unterminated strings or extra trailing data.
* Reject serialized SSL contexts whose DTLS Connection ID length exceeds
the maximum supported size, instead of overflowing the internal buffer.
* Fix bug in configurations with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED that
prevented re-use of an mbedtls_ecdh_context for static ECDH: our secret key
was wiped after its first use to compute a shared secret.
* Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration
is applied to all subsequent handshakes, not just to the next one.
* Reject malformed X.509 CSRs where the extensionRequest attribute
wrappers do not exactly contain the requested extensions.
Changes
* X.509 certificates with a basicConstraints extension starting with an
INTEGER field are no longer accepted. According to RFC 5280, such
certificates are syntactically valid and the first field is the
pathLenConstraint value, but certificate authorities must not emit such
certificates. Mbed TLS interpreted it as a cA value, which was nonstandard
and dangerous.
= Mbed TLS 3.6.6 branch released 2026-03-31
Features

17
ChangeLog.d/1583-1584-ssl-transcript-errors.txt
View File

@ -1,17 +0,0 @@
Security
* Fix a bug where transcript-hash computation errors during TLS 1.2
extended master secret calculation could be ignored instead of causing the
handshake to fail. This could allow a handshake to continue with a master
secret that was not correctly bound to the handshake transcript,
undermining the security guarantees of the extended master secret
extension. Report by Mathew Gretton-Dann. CVE-2026-50581
* Fix a TLS 1.3 server-side error-handling bug affecting session ticket
generation. Under rare conditions, such as memory allocation failures
while computing the resumption master secret, the server could issue
invalid session tickets instead of failing the handshake. Clients
presented with such tickets would fail session resumption and fall back to
a full handshake. In deployments relying on session resumption, repeated
occurrences could increase the frequency of full handshakes and amplify
resource consumption during periods of resource exhaustion or other
transient failures. Reported by jjfz123.
CVE-2026-50640

4
ChangeLog.d/badmac_seen_or_in_hsfraglen.txt
View File

@ -1,4 +0,0 @@
Security
* Fix renegotiation failing and potentially causing a buffer overflow
in DTLS when badmac_limit is enabled. Reported by Haruki Oyama.
CVE-2026-50713.

4
ChangeLog.d/chacha20-counter-overflow.txt
View File

@ -1,4 +0,0 @@
Security
* Reject ChaCha20 operations that would make the 32-bit block counter wrap
around, which could otherwise reuse keystream and compromise
confidentiality. Reported by jiliang. CVE-2026-50584

7
ChangeLog.d/drop-early-data.txt
View File

@ -1,7 +0,0 @@
Security
* Fixed a TLS 1.3 record-boundary validation issue that could allow
unauthenticated plaintext data to be processed across a key change. In
servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a
man-in-the-middle attacker to cause loss of 0-RTT early data.
Reported by Ben Smyth.
CVE-2026-TODO.

6
ChangeLog.d/ecdh-legacy-buffer-overflow.txt
View File

@ -1,6 +0,0 @@
Security
* Fix a possible buffer overflow in mbedtls_ecdh_calc_secret(): when the
provided output buffer is too small, sometimes (depending on the value of
the computed shared secret), the function would not return an error as it
should, but instead write past the end of the buffer. Reported by Eva
Crystal (0xiviel) from XSource Security. CVE-2026-35336.

3
ChangeLog.d/ecdh-psk-integer-overflow.txt
View File

@ -1,3 +0,0 @@
Security
* Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when
CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580

6
ChangeLog.d/ecp-modp-side-channel.txt
View File

@ -1,6 +0,0 @@
Security
* Fix a side channel in ECC computations that allows a powerful local
attacker (typically, untrusted OS attacking a secure enclave) to fully
recover long-term secret keys. Found and reported by Alejandro Cabrera
Aldaya from Tampere University. CVE-2026-54435

4
ChangeLog.d/fix-ecdh-context-reuse.txt
View File

@ -1,4 +0,0 @@
Bugfix
* Fix bug in configurations with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED that
prevented re-use of an mbedtls_ecdh_context for static ECDH: our secret key
was wiped after its first use to compute a shared secret.

6
ChangeLog.d/fix-info-leak-in-ssl.txt
View File

@ -1,6 +0,0 @@
Security
* Fix a potential information disclosure in TLS 1.2 servers using session
tickets. If the session ticket write callback failed without setting the
lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized
stack memory to the peer in the NewSessionTicket message. Fixes #1570.
Reported by James Love. CVE-2026-50586.

4
ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt
View File

@ -1,4 +0,0 @@
Bugfix
* Fix a TLS 1.2 regression that caused clients to reject valid
ServerKeyExchange signatures using RSA-PSS signature algorithms.
Fixes #10668.

5
ChangeLog.d/harden-check-small-primes.txt
View File

@ -1,5 +0,0 @@
Security
* Fix timing side channel in RSA key generation, prime generation and
primality testing, on platforms where division is not constant-time. At
this point this side channel is not known to be exploitable. Reported by
Bhargava Shastry, Ethereum Foundation.

6
ChangeLog.d/iar-alignment-fix.txt
View File

@ -1,6 +0,0 @@
Bugfix
* Fix a problem in library/alignment.h where the Zephyr Project use
a pre-defined macro '__packed' which collides with the IAR keyword
'__packed', causing the typedefs of unaligned types to remain aligned.
Fixes mbedtls issue #10334

4
ChangeLog.d/mbedtls_pk_ecc_set_pubkey.txt
View File

@ -1,4 +0,0 @@
Security
* Fix a 1-byte buffer overread when parsing a malformed ECC public key
in the PK module. CVE-2026-50583

3
ChangeLog.d/mbedtls_ssl_set_cid-documentation.txt
View File

@ -1,3 +0,0 @@
Bugfix
* Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration
is applied to all subsequent handshakes, not just to the next one.

4
ChangeLog.d/oob-key-exchange-restricted.txt
View File

@ -1,4 +0,0 @@
Security
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange
messages. Reported-by Biniam Demissie.
CVE-2026-50588

6
ChangeLog.d/pkcs-free-stale-pointers.txt
View File

@ -1,6 +0,0 @@
Security
* Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing
an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The
function now resets the context after freeing it, ensuring stale
signed_data.signers.next pointers cannot be walked by a later free
operation. CVE-2026-50579

9
ChangeLog.d/pkcs7-reject-weak-hashes.txt
View File

@ -1,9 +0,0 @@
Security
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
SHA3-224) on signature verification. The new configuration option
MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
algorithms in PKCS7 for backward compatibility purposes.
Features
* SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
certificate profile.

8
ChangeLog.d/rsa-padding.txt
View File

@ -1,8 +0,0 @@
Security
* Fix a side channel in RSA PKCS#1 v1.5 decryption: error handling in the
library would reveal through timing the difference between success,
invalid padding, or output too large for buffer, giving rise to a
Bleichenbacher attack. Note that while the library now handles sensitive
errors in constant-time, RSA PKCS#1 v1.5 decryption remains inherently
dangerous, should be avoided when possible, and otherwise requires great
care in application code. Found by zhengg. CVE-2026-50587

2
ChangeLog.d/security-advice.txt
View File

@ -1,2 +0,0 @@
Security
* Added advice about compiler options in SECURITY.md.

7
ChangeLog.d/security-issue1569.txt
View File

@ -1,7 +0,0 @@
Security
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that
this function only sets signature algorithms that are enforced during
TLS key exchange and not on certificate verification. Reported by
Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT).
CVE-2026-54441

6
ChangeLog.d/security1585.txt
View File

@ -1,6 +0,0 @@
Security
* Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context'
is properly zeroized when mbedtls_ssl_session_reset() is called. This
could cause incorrect DTLS-SRTP parameter inheritance for applications
reusing an SSL context.
Reported by jjfz123. CVE-2026-50585.

5
ChangeLog.d/serialized-data-load-hardening.txt
View File

@ -1,5 +0,0 @@
Bugfix
* Reject malformed TLS 1.3 serialized sessions instead of accepting
unterminated strings or extra trailing data.
* Reject serialized SSL contexts whose DTLS Connection ID length exceeds
the maximum supported size, instead of overflowing the internal buffer.

5
ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt
View File

@ -1,5 +0,0 @@
Security
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return
1 instead of an error code if the random generator failed when a server
called these functions before the end of a TLS 1.3 handshake.
Reported by Mohammad Seet (mhdsait101). CVE-2026-40294

7
ChangeLog.d/tls13-hrr-selected-group.txt
View File

@ -1,7 +0,0 @@
Security
* Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was
not advertised in the original ClientHello. Reported independently by
Din Asotić / Xiangdong Li, Beijing University of Posts and
Telecommunications (BUPT), and NVIDIA Project Vanessa.
CVE-2026-25832.

15
ChangeLog.d/x509-crt-parse-basicConstraints.txt
View File

@ -1,15 +0,0 @@
Security
* Fix two bugs in the X.509 certificate parser that caused some inputs
with a malformed basicConstraints extension to be accepted. This
could have dangerous results, in particular causing some certificates
to be parsed as CA certificates when other X.509 implementations would
parse them as end-entity certificates. Reported by Mohammad Seet
(mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300
Changes
* X.509 certificates with a basicConstraints extension starting with an
INTEGER field are no longer accepted. According to RFC 5280, such
certificates are syntactically valid and the first field is the
pathLenConstraint value, but certificate authorities must not emit such
certificates. Mbed TLS interpreted it as a cA value, which was nonstandard
and dangerous.

3
ChangeLog.d/x509-csr-extension-request-bounds.txt
View File

@ -1,3 +0,0 @@
Bugfix
* Reject malformed X.509 CSRs where the extensionRequest attribute
wrappers do not exactly contain the requested extensions.