Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Mbed TLS can be tricked into running malicious code
published 5 months ago
Summary
Versions of the Mbed TLS library from 2.19.0 through 3.6.5 and 4.0.0 do not adequately protect saved connection data. An attacker who can change this saved data could cause the software to crash or execute code of their choosing. Update to a patched version of Mbed TLS as soon as possible.
What to do
- Update echo mbedtls to version 3.6.6-0.1+e1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | mbedtls |
< 3.6.6-0.1+e1 Fix: upgrade to 3.6.6-0.1+e1
|
Original advisory text
Serialized SSL context tampering is documented behavior; callers must protect serialized data.
https://security-tracker.debian.org/tracker/CVE-2026-34877
References
Timeline
Published27 May 2026
Updated29 May 2026
First seen27 May 2026
Sources
ECHO-b6fa-1bcf-5451 · OSV
Track software like this
Free during beta