[Debian-iot-maintainers] Bug#1133841: mbedtls: CVE-2026-25833 CVE-2026-25834 CVE-2026-25835

[Salvatore Bonaccorso]

Source: mbedtls
Version: 3.6.5-0.1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for mbedtls.

CVE-2026-25833[0]:
| Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer
| overflow in the x509_inet_pton_ipv6() function


CVE-2026-25834[1]:
| Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.


CVE-2026-25835[2]:
| Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in
| a Pseudo-Random Number Generator (PRNG).


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-25833
    https://www.cve.org/CVERecord?id=CVE-2026-25833
[1] https://security-tracker.debian.org/tracker/CVE-2026-25834
    https://www.cve.org/CVERecord?id=CVE-2026-25834
[2] https://security-tracker.debian.org/tracker/CVE-2026-25835
    https://www.cve.org/CVERecord?id=CVE-2026-25835

Regards,
Salvatore