CRITICAL 9.1 Microsoft

CVE-2026-34872

An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values (lack of contributory behavior). This is a problem for protocols that depend on contributory behavior (which is not the case for TLS). The attack can be carried by the peer, or depending on the protocol by an active network attacker (person in the middle).

Microsoft Security Update 2026-Apr: An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values (lack of contributory behavior). This is a problem for protocols that depend on contributory behavior (which is not the case for TLS). The attack can be carried by the peer, or depending on the protocol by an active network attacker (person in the middle).

Affected Products

References

Published: 2026-04-14 · Source: Microsoft · Feed updated: 2026-08-10
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-04-14 via Microsoft. Affected: azl3 nodejs24 24.14.1-2 on Azure Linux 3.0, azl3 nodejs 24.14.1-3 on Azure Linux 3.0.

Risk Timeline

CVE Disclosed2026-04-14 · 117 days ago

Remediation Resources

Related Vulnerabilities

CVETitleSeverityCVSS
CVE-2026-40175Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCRITICAL10.0
CVE-2024-24576 PoCRusts's `std::process::Command` did not properly escape arguments of batch filesCRITICAL10.0
CVE-2026-44210Kata Containers have VM Escape via virtiofsd Argument Injection through Default-CRITICAL9.9
CVE-2026-64562KVM: nVMX: Hide shadow VMCS right after VMCLEARCRITICAL9.8
CVE-2026-64565Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()CRITICAL9.8
CVE-2026-64584usb: gadget: f_midi: cancel pending IN work before freeing the midi objectCRITICAL9.8
vulnfeed aggregates 9044 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.