CVE-2026-34872
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values (lack of contributory behavior). This is a problem for protocols that depend on contributory behavior (which is not the case for TLS). The attack can be carried by the peer, or depending on the protocol by an active network attacker (person in the middle).
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceMbed TLS's finite-field Diffie-Hellman (FFDH) implementation has improper input validation that allows a malicious peer or MITM attacker to force the shared secret into a small set of predictable values, breaking contributory behavior required by certain protocols.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 3.6.6= 1.0.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check Mbed TLS library versionInspect the library binary or headers for the version string. In code, you can call mbedtls_version_check() or check the MBEDTLS_VERSION_MAJOR, MBEDTLS_VERSION_MINOR, MBEDTLS_VERSION_PATCH macros from mbedtls/version.h. If using a package manager or build system, query the installed package version.Affected if The installed version is earlier than 3.6.6 (for example, 3.5.x, 3.4.x, or 2.x releases).
-
Check Tf Psa Crypto versionIf your application uses the PSA Crypto API, query the library version via psa_get_library_version() or inspect the compiled library/binary for version markers. Check build artifacts or dependency manifests for the tf-psa-crypto version.Affected if The tf-psa-crypto version is exactly 1.0.0.
-
Verify FFDH/DHM support is enabledInspect the build configuration (config.h or build flags) for the presence of MBEDTLS_DHM_C or MBEDTLS_FFDHE_C preprocessor macros. These enable the Finite Field Diffie-Hellman implementation that contains the vulnerability. If using a pre-built library, check if it was compiled with DHM support.Affected if MBEDTLS_DHM_C or MBEDTLS_FFDHE_C is defined and the FFDH module is included in the build.
-
Identify FFDH usage in application codeSearch source code for calls to mbedtls_dhm_read_public(), mbedtls_dhm_make_public(), or PSA DH key agreement operations (psa_key_agreement with PSA_ALG_FFDH). Review crypto configuration files to see if FFDH key exchange is configured for any TLS or custom protocols.Affected if The application performs DH key exchange operations or uses PSA key agreement with FFDH algorithms, and the peer public key is processed by the vulnerable code path.
You are affected if you use Mbed TLS earlier than 3.6.6 or tf-psa-crypto version 1.0.0 AND have FFDH/DHM operations enabled and actively use them in your application.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped3.6.6
Upgrade Mbed TLS to version 3.6.6 or later (or 3.5.x to patched version) and TF-PSA-Crypto to patched version; audit protocols using FFDH to verify they don't depend on contributory behavior.
Mbed TLS 3.6.6 (or later) / TF-PSA-Crypto version containing the fix
- 1. Identify all applications and systems using Mbed TLS libraries (versions prior to 3.6.6) or TF-PSA-Crypto (version 1.0.0) that utilize finite-field Diffie-Hellman (FFDH)
- 2. For projects using package managers (e.g., apt, yum, brew, conan, vcpkg), update the mbedtls package to version 3.6.6 or later
- 3. For projects using mbedtls as a submodule or direct source integration, pull the latest release from the mbedtls repository (release 3.6.6 or later)
- 4. Rebuild and recompile all dependent applications after updating the library
- 5. Test the FFDH functionality to verify the fix is working correctly
- 6. Deploy the updated binaries to all production environments
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing12.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,616.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-34872 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-34872 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data