CVE-2026-73064LowCVSS 2.9

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Published
October 3, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-73064 →

🎯 Affected products2

  • azl3 nodejs 24.21.0-1 on Azure Linux 3.0
  • azl3 nodejs 24.22.0-1 on Azure Linux 3.0

✅ Remediation

KBRelease Notes (Security Update)

🔗 References (2)