CVE-2026-34873

The vulnerability results from improper verification of client identity (CWE-287 — improper authentication) in the TLS 1.3 session resumption mechanism. An attacker can conduct an attack consisting of impersonating a previously authenticated client during the session resumption procedure, thereby bypassing standard identity verification mechanisms. The attack vector is network-based, requires no privileges or user interaction.

An attacker can effectively impersonate a legitimate client and gain unauthorized access to resources or data protected by the TLS connection, as well as modify transmitted information, constituting a serious violation of confidentiality and integrity of communication.

Apply patches available from the vendor according to the references. Details regarding patched versions are described in the Mbed TLS security bulletin: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/

Arm Mbed TLS in versions from 3.5.0 to 4.0.0 inclusive.