diff --git a/ChangeLog.d/tls12-reject-tls13-ticket.txt b/ChangeLog.d/tls12-reject-tls13-ticket.txt
new file mode 100644
index 0000000000..c31207c0ab
--- /dev/null
+++ b/ChangeLog.d/tls12-reject-tls13-ticket.txt
@@ -0,0 +1,8 @@
+Security
+   * Fix a TLS 1.2 server accepting a session ticket that was issued for a
+     TLS 1.3 session. The session was resumed with an all-zero master secret,
+     so anyone holding the ticket could complete the abbreviated handshake and
+     derive the connection keys from public handshake values. TLS 1.3 tickets
+     appear in clear in the pre_shared_key extension of a TLS 1.3 resumption
+     ClientHello. This affects servers that enable both TLS 1.2 and TLS 1.3
+     and session tickets.
diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index 598f8b946b..cded600873 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -480,6 +480,16 @@ static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl,
         return 0;
     }
 
+    /*
+     * A ticket issued for a TLS 1.3 session has no TLS 1.2 master secret,
+     * so it must not be used to resume a TLS 1.2 session.
+     */
+    if (session.tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
+        mbedtls_ssl_session_free(&session);
+        MBEDTLS_SSL_DEBUG_MSG(3, ("ticket TLS version is not 1.2"));
+        return 0;
+    }
+
     /*
      * Keep the session ID sent by the client, since we MUST send it back to
      * inform them we're accepting the ticket  (RFC 5077 section 3.4)