Description

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-14T07:17:16.490Z",
  "pubdate": "2026-09-14T07:17:16.490Z",
  "executiveSummary": "This vulnerability involves an improper validation mechanism within Mbed TLS 3.6.x (before 3.6.7) and 4.1.x (before 4.1.2) during the TLS 1.3 handshake process.\nThe flaw specifically affects the TLS 1.3 client implementation, which fails to verify that the named group selected by a server's HelloRetryRequest (HRR) was previously advertised by the client in its original ClientHello message.\nThis violation of the TLS 1.3 protocol specification (RFC 8446) allows a malicious server to force the client to negotiate a cryptographic group that was not intended or perhaps not supported by the client's local security policy.\nThe vulnerability poses risks to the integrity of the cryptographic handshake, potentially facilitating downgrade attacks or forcing the client to utilize weaker or non-existent key exchange parameters.\nExploitation requires an attacker to act as a malicious server during the initial phase of the TLS handshake. No user interaction or prior authentication is required, as the vulnerability is triggered automatically during the negotiation phase.\nThe impact includes a weakened security posture for the TLS connection, potentially exposing session keys or allowing for cryptographic bypasses depending on the implementation details of the forced, unadvertised group.",
  "technicalDetails": "The vulnerability resides in the TLS 1.3 handshake state machine, specifically within the logic responsible for processing the HelloRetryRequest (HRR) server message. According to RFC 8446, when a server sends an HRR, it must select a named group that was included in the 'supported_groups' extension of the client's original ClientHello. If a client receives a group that it did not advertise, it is required to abort the handshake with an 'illegal_parameter' alert.\nIn the affected Mbed TLS versions, the client implementation lacks this critical check. When a server issues an HRR with an arbitrary or unadvertised named group, the Mbed TLS client proceeds to incorporate this group into the subsequent key exchange process without validation.\nThe attack flow proceeds as follows: 1) The client initiates a TLS 1.3 connection by sending a ClientHello, including a list of supported groups. 2) The malicious server responds with a HelloRetryRequest containing a group identifier that was intentionally excluded from the client's original list. 3) The vulnerable client, failing to verify the group against its previous advertisement, updates its state to use the attacker-specified group. 4) The client continues the handshake using the attacker-selected parameters, allowing the server to dictate the cryptographic primitives used for the key exchange.\nThis flaw effectively bypasses the client-side preference and policy enforcement for secure key exchange. By forcing the client into a specific group, the attacker may potentially steer the handshake toward groups known to be vulnerable, computationally easier to compromise, or unsupported by the client's intended security hardened configuration.\nThe root cause is a failure in the state machine transition logic that fails to enforce the protocol constraint regarding the 'named_group' field within the HRR extension. Because the client trusts the server-provided group blindly, the integrity of the TLS negotiation is compromised, allowing for a breach of the expected security guarantees established at the start of the connection.\nThe vulnerability affects Mbed TLS 3.6.x prior to 3.6.7 and Mbed TLS 4.1.x prior to 4.1.2. The exposure is limited to TLS 1.3 sessions and requires the attacker to be positioned to intercept or respond to the client's connection attempt as a server."
}