# TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group (CVE-2026-25832)

**Title** | TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group
--------- | ----------------------------------------------------------
**CVE** | CVE-2026-25832
**Date** | 7th of July, 2026
**Affects** | Mbed TLS 3.5.0 through 3.6.6, all Mbed TLS 4 versions up to 4.1.1
**Not affected** | all versions up to and including 3.4.1, Mbed TLS 3.6.7 and later, and Mbed TLS 4.1.2 and later.
**Impact** | TLS 1.3 client group policy bypass; Limited denial of service in some configurations
**Severity** | LOW
**Credits** | Din Asotic / Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT) / Bin Luo, University of Electronic Science and Technology of China (UESTC)

## Vulnerability

When an Mbed TLS client processes a TLS 1.3 HelloRetryRequest, it is required to check that the `selected_group` in the server's `key_share` extension was present in the `supported_groups` extension of the original ClientHello. If this check fails, RFC 8446 requires the client to abort the handshake with an `illegal_parameter` alert.

Affected versions did not correctly perform this validation.

A misbehaving server could use HelloRetryRequest to nudge the client into bypassing its security policy by selecting a cryptographic group that the client did not advertise.

## Impact

The impact is low: a malicious/misbehaving server can bypass a TLS 1.3 client's configured group policy, or cause handshake failure when selecting an unacceptable group. This does not by itself compromise session keys or certificates.

## Affected versions

All Mbed TLS 3.5 versions, all 3.6 versions up to 3.6.6,  all Mbed TLS 4 versions up to 4.1.1.

Applications are affected when all of the following are true:

* TLS 1.3 client support is enabled.
* A TLS 1.3 ephemeral or PSK-ephemeral key exchange mode is enabled.
* The application relies on `mbedtls_ssl_conf_groups()` or equivalent configuration to restrict the groups that the client may offer.
* The client connects to a malicious or compromised server that sends a HelloRetryRequest selecting a group outside the client's originally advertised `supported_groups` list.

## Work-around

Where upgrading is not immediately possible, applications can avoid exposure by disabling TLS 1.3 client connections, or by only connecting TLS 1.3 clients to trusted servers that cannot send malicious HelloRetryRequest messages.

Applications are not affected if they do not enable TLS 1.3 client support, use TLS 1.3 PSK-only key exchange, or do not rely on the TLS 1.3 supported group list as a security or compliance boundary.

## Resolution

Affected users of the 3.6 LTS branch should upgrade to 3.6.7 or later. Affected users of the 4.x series should upgrade to 4.1.2 or later.

## Fix commits

We recommend that users upgrade to a release including the fix. However, if you are maintaining a branch with backported bug fixes, here are the most relevant commits. Please note that these commits may not apply cleanly to older versions of the library, and may not provide a complete fix even if they do apply. The Mbed TLS development team does not provide support outside of maintained branches.

| Branch | Mbed TLS 3.6.x | TF-PSA-Crypto 1.1.x | TF-PSA-Crypto 1.x (x>1) | Mbed TLS 4.1.x | Mbed TLS 4.x (x>1) |
| ------ | -------------- | ------------------- | -------------------------- | -------------- | --------------------- |
| Basic fix | 55ccd932658b933f224cc0384ab5a5197e5680e2 | Not applicable  | Not applicable  | cec2cef6b5ce9ae3cb2bbcd43f3ac8c06f1f9508 | 902762039334c91813ab9e9ba8ccef5356e819e4 |
| With tests and documentation | aecc26ac7c..8c458b8cca4c4a55142efd65348e93595ec71723 | Not applicable  | Not applicable  | b2e36d7d7a..e16f0e0b014be310f423de5e52109cd0712db6f7 | cb4d172ce0..e2a6f05640528b1eff715824f3d931b81e7c911d |