LOW 2.9 Microsoft
CVE-2026-73064
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
Microsoft Security Update 2026-Sep: In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
Affected Products
- azl3 nodejs 24.21.0-1 on Azure Linux 3.0
- azl3 nodejs 24.22.1-1 on Azure Linux 3.0
- azl3 nodejs 24.22.0-1 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73064
- https://nvd.nist.gov/vuln/detail/CVE-2026-73064
This low severity vulnerability with a CVSS score of 2.9 was published on 2026-09-08 via Microsoft. Affected: azl3 nodejs 24.21.0-1 on Azure Linux 3.0, azl3 nodejs 24.22.1-1 on Azure Linux 3.0, azl3 nodejs 24.22.0-1 on Azure Linux 3.0.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.