# A random generator fault can compromise TLS data integrity (CVE-TODO)

**Title** | A random generator fault can compromise TLS data integrity
--------- | ----------------------------------------------------------
**CVE** | CVE-TODO
**Date** | 7th of July, 2026
**Affects** | All versions of Mbed TLS from 3.2.0 to 3.6.6; Mbed TLS 4.0.0; Mbed TLS 4.1.0
**Not affected** | Mbed TLS 3.6.7 and later 3.6.x versions; Mbed TLS 4.1.1 and later 4.1.x version; Mbed TLS 4.2.0 and later 4.x versions
**Impact** | TLS 1.3 application data integrity
**Severity** | LOW
**Credits** | Mohammad Seet (mhdsait101)

## Vulnerability

A logic error in `ssl_tls13_prepare_new_session_ticket()` causes it to return 1 rather than a negative error code if `psa_generate_random()` fails. On some platforms, an attacker with physical or local access may glitch the entropy source, which can cause `psa_generate_random()` to fail, depending on the random generator configuration.

The TLS library internally treats any nonzero value as an error, so for the most part, the impact is limited to returning the wrong error code for this error condition. However, applications may call `mbedtls_ssl_read()` or `mbedtls_ssl_write()` before the handshake is complete, in which case the functions will try to complete the handshake (and return `MBEDTLS_ERR_SSL_WANT_READ` or `MBEDTLS_ERR_SSL_WANT_WRITE`). If `ssl_tls13_prepare_new_session_ticket()` returns 1 due to the random generator failure, `mbedtls_ssl_read()` or `mbedtls_ssl_write()` returns 1, letting the application believe that one byte of application data has been read or written. With `mbedtls_ssl_read()`, the byte value that has seemingly been read is the previous content of the output buffer.

## Impact

Consider an application running a TLS server, that receives a TLS 1.3 connection. Suppose that an attacker can cause the platform's entropy source to fail.

If the application calls `mbedtls_ssl_read()` before the TLS handshake is over, the attacker can inject extra data before the actual data from the client. The attacker can control how many bytes are injected, but not the value of these bytes.

If the application calls `mbedtls_ssl_write()` before the TLS handshake is over, the attacker can cause some initial bytes not to be sent from the server.

## Affected versions

All versions of Mbed TLS 3.x from 3.2.0 to 3.6.6 are affected. Mbed TLS 4.0.0 and 4.1.0 are affected.

## Work-around

Applications are only affected if they call `mbedtls_ssl_read()` or `mbedtls_ssl_write()` before the initial TLS handshake is over.

The bug only affects TLS 1.3 servers. TLS 1.2 connections are not affected, and in particular renegotiation handshakes are not affected.

Applications are only affected if they issue TLS 1.3 session tickets. They only do so when `MBEDTLS_SSL_SESSION_TICKETS` is enabled (it is enabled by default) and the application has configured a ticket callback with `mbedtls_ssl_conf_session_tickets_cb()`. Furthermore tickets are not issued if the application has disabled them by calling `mbedtls_ssl_conf_new_session_tickets()` with a count of 0.

Applications are only affected if the random generator is configured to fail if the entropy source fails, which is the case by default, but can be avoided by setting the reseed interval to `INT_MAX`.

## Resolution

Affected users should upgrade to Mbed TLS 3.6.7, Mbed TLS 4.1.1 or Mbed TLS 4.2.0 depending on which branch they are tracking.

## Fix commits

We recommend that users upgrade to a release including the fix. However, if you are maintaining a branch with backported bug fixes, here are the most relevant commits. Please note that these commits may not apply cleanly to older versions of the library, and may not provide a complete fix even if they do apply. The Mbed TLS development team does not provide support outside of maintained branches.

| Branch | Mbed TLS 3.6.x | Mbed TLS 4.1.x | Mbed TLS 4.x (x>1) |
| ------ | -------------- | -------------- | --------------------- |
| Basic fix | a5699bdb914ac6f65c867cf842911cdaa9d5618e | 465d6e9669a24ff7fe1a018fafe0e9f44aa4a48b | 465d6e9669a24ff7fe1a018fafe0e9f44aa4a48b |
| With tests and documentation | 77b1a22bc31d0017b07425bba61e5a4ecb82b9c5..8b7af9d421c62497f3a4e4a8be476b7fe8323c3f | 0fe989b6b514192783c469039edd325fd0989806..b05434c1b1df14cb3b2ce52dd1200c3ba9f9b198 | 0fe989b6b514192783c469039edd325fd0989806..b05434c1b1df14cb3b2ce52dd1200c3ba9f9b198 |