# Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing (CVE-2026-50588)

**Title** | Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing
--------- | ----------------------------------------------------------
**CVE** | CVE-2026-50588
**Date** | 7th of July, 2026
**Affects** | Mbed TLS 3.3.0 through 3.6.6; Mbed TLS 4.0.0 through 4.1.0
**Not affected** | Mbed TLS before 3.3.0; Mbed TLS 3.6.7 and later 3.6.x versions; Mbed TLS 4.1.1 and later 4.1.x versions; Mbed TLS 4.2.0 and later 4.x versions
**Impact** | A malicious TLS 1.2 server can cause a client to read outside the validated ServerKeyExchange message while parsing an EC J-PAKE key exchange
**Severity** | LOW
**Credits** | Biniam Demissie

## Vulnerability

In TLS 1.2 clients, when parsing a ServerKeyExchange message for the EC J-PAKE
ciphersuite, Mbed TLS read the first three bytes of the EC J-PAKE key exchange
parameters before checking that three bytes were present in the message body.
These bytes encode the curve type and the TLS named curve identifier.

If a malicious TLS 1.2 server selected the
`MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8` ciphersuite and sent a truncated
ServerKeyExchange message, the client could read beyond the validated end of
the current handshake message. If the bytes read beyond the message happened to
match the expected curve encoding, subsequent EC J-PAKE parsing could consume a
larger amount of data outside the message boundary.

This vulnerability only affects builds with
`MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED` enabled. EC J-PAKE support is disabled
in the default Mbed TLS configuration.

## Impact

A malicious TLS 1.2 server can trigger an out-of-bounds read in an affected
client during the handshake. In most configurations, the read remains within
the TLS input buffer and reads stale data from outside the current handshake
message. In configurations where the TLS input buffer is too small for an
EC J-PAKE handshake, the read can go past the end of the heap buffer.

The overread data is not copied back to the peer. The practical information
leakage is limited to whether the overread data is accepted by later parsing,
so the severity is LOW.

## Affected versions

Mbed TLS versions 3.3.0 through 3.6.6 and 4.0.0 through 4.1.0 are affected when
`MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED` is enabled.

Mbed TLS versions before 3.3.0 do not have the affected EC J-PAKE
ServerKeyExchange parsing code. Mbed TLS 3.6.7 and later 3.6.x versions,
Mbed TLS 4.1.1 and later 4.1.x versions, and Mbed TLS 4.2.0 and later 4.x
versions, are not affected.

## Work-around

Disable TLS 1.2 EC J-PAKE support by disabling
`MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED`, or ensure that clients do not offer the
`MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8` ciphersuite.

Applications that are built without `MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED`, do
not use TLS clients, only use TLS 1.3, or never allow negotiation of the
EC J-PAKE ciphersuite are not vulnerable.

## Resolution

Affected users should upgrade to Mbed TLS 3.6.7 or a later 3.6.x version,
Mbed TLS 4.1.1 or a later 4.1.x version, or Mbed TLS 4.2.0 or a later version.

## Fix commits

We recommend that users upgrade to a release including the fix. However, if you are maintaining a branch with backported bug fixes, here are the most relevant commits. Please note that these commits may not apply cleanly to older versions of the library, and may not provide a complete fix even if they do apply. The Mbed TLS development team does not provide support outside of maintained branches.

| Branch | Mbed TLS 3.6.x | TF-PSA-Crypto 1.1.x | TF-PSA-Crypto 1.x (x>1) | Mbed TLS 4.1.x | Mbed TLS 4.x (x>1) |
| ------ | -------------- | ------------------- | -------------------------- | -------------- | --------------------- |
| Basic fix | e3be807e5c5ce216b8b832b1e746e4ef5c0765bf | N/A | N/A | 1ac3989db6cd0416f562764e3bfacca62ce4875c | 08e3e3f81e6c5703c3afcbfcb47c600a2b10afcb |
| With tests and documentation | e3be807e5c5ce216b8b832b1e746e4ef5c0765bf^..e1351f7881991951049fdcca230edd85dcde6f90 | N/A | N/A | 1ac3989db6cd0416f562764e3bfacca62ce4875c^..1a5e328377af66a1795ebf9440e79592bffa2a71 | 08e3e3f81e6c5703c3afcbfcb47c600a2b10afcb^..1aa125454601ef3492c285d2122518ac3fa3b6c2 |