CVE-2026-34872

During FFDH key exchange, each party should provide an independent, random contribution to the shared secret (contributory behavior). Due to the lack of proper validation of input data transmitted by the other party, an attacking peer or active network attacker can send a crafted public key, forcing the resulting shared secret to derive from only a very small, predictable set of values. This significantly reduces the security of key exchange in protocols that assume full randomness of both parties' contributions. The attack does not affect the TLS protocol itself, but other protocols using FFDH through these libraries.

An attacker can learn or narrow the scope of a shared cryptographic secret, leading to violations of confidentiality and integrity of communications in protocols dependent on contributory behavior in FFDH. Depending on the protocol, the attack can be conducted by either a direct peer or an active network attacker (man-in-the-middle).

Patches available from the vendor should be applied according to the references. Detailed information about available patched versions is available in the official Mbed TLS security advisory: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-peerkey-checks/

Arm Mbed TLS in versions 3.5.x and 3.6.x through 3.6.5 inclusive, as well as Arm TF-PSA-Crypto version 1.0