Skip to main content

CVE-2026-25834

| EUVDEUVD-2026-17967 MEDIUM
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
2026-04-01 mitre
Information Disclosure
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Patch released
Apr 10, 2026 - 08:30 nvd
Patch available
EUVD ID Assigned
Apr 01, 2026 - 18:15 euvd
EUVD-2026-17967
Analysis Generated
Apr 01, 2026 - 18:15 vuln.today
CVE Published
Apr 01, 2026 - 00:00 nvd
MEDIUM 6.5

DescriptionCVE.org

Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.

AnalysisAI

Mbed TLS versions 3.3.0 through 3.6.5 and 4.0.0 are vulnerable to algorithm downgrade attacks via signature algorithm injection, allowing attackers to force the use of weaker cryptographic algorithms during TLS handshakes. This information disclosure vulnerability affects all applications using the affected Mbed TLS library versions and could enable attackers to compromise the confidentiality of encrypted communications by downgrading to algorithms with known weaknesses.

Technical ContextAI

Mbed TLS is a widely-used open-source cryptographic library that implements TLS/SSL protocols and X.509 certificate handling. The vulnerability stems from improper validation of signature algorithm parameters during the TLS handshake process, allowing attackers to inject or manipulate algorithm selection without proper verification. This represents a flaw in the protocol state machine or parameter negotiation logic that fails to restrict algorithm choices to those explicitly supported or previously agreed upon by both parties, leading to a downgrade attack vector where stronger algorithms are replaced with weaker alternatives.

RemediationAI

Upgrade Mbed TLS to a patched version released after the security advisory publication date. Users of the 3.x branch should upgrade to the earliest available version after 3.6.5; users of the 4.0.x branch should upgrade to the earliest patched 4.0.x release. Until patching is possible, review TLS server configurations to disable support for legacy or weak signature algorithms (SHA-1, MD5) and enforce minimum algorithm strength policies. Consult the official Mbed TLS security advisory at https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-sigalg-injection/ for exact patched version numbers and additional mitigation guidance.

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all
CVE-2022-3365 CRITICAL POC
9.8
CVE-2014-8687 CRITICAL POC
9.8
CVE-2017-17382 MEDIUM POC
5.9
CVE-2016-6602 CRITICAL POC
9.8
CVE-2023-34039 CRITICAL POC
9.8
CVE-2025-2539 HIGH POC
7.5
CVE-2017-9466 CRITICAL POC
9.8
CVE-2023-5347 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed

Share

CVE-2026-25834 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy