Issues

• Request: compatibility option for basicConstraints = SEQUENCE { INTEGER n } (rejected since 3.6.7 / CVE-2026-49300 fix), emitted by Eaton/CODESYS PLCs

  bugcomponent-x509
  Mbed-TLS/mbedtls#11006 · Filter by author heppth opened on Oct 13, 2026
  1

• mbedtls_oid_get_numeric_string caps an OID subidentifier at 32 bits, rejecting conformant OIDs (decode-side sibling of #10910)

  bugcomponent-x509good-first-issue
  Mbed-TLS/mbedtls#11001 · Filter by author LukeW1999 opened on Oct 9, 2026
  2

• Support for DTLS 1.3

  enhancement
  Mbed-TLS/mbedtls#10982 · Filter by author devArnoud opened on Oct 2, 2026

• Test TLS 1.2 hash and signature algorithm policy enforcement

  enhancementsize-s
  Task

  Mbed-TLS/mbedtls#10981 · Filter by author gilles-peskine-arm opened on Oct 1, 2026
  2

• mbedtls_sha256_update produces incorrect result if ilen >= 0x100000000

  bugcomponent-crypto
  Mbed-TLS/mbedtls#10964 · Filter by author TimothyPMann opened on Sep 22, 2026
  4

  

• tests_suite_ssl: remove certificate loading for PSK based tests using move_handshake_to_state test function

  enhancementpriority-medium
  Mbed-TLS/mbedtls#10962 · Filter by author valeriosetti opened on Sep 22, 2026
  

• TLS 1.3: Opaque PSK silently fails

  bugcomponent-psacomponent-tls13size-m
  Mbed-TLS/mbedtls#10956 · Filter by author mschulz-at-hilscher opened on Sep 16, 2026

• Unsigned-underflow-dependent bounds check in mbedtls_nist_kw_unwrap() (robustness only, verified not exploitable)

  bugcomponent-cryptopriority-lowsize-s
  Mbed-TLS/mbedtls#10955 · Filter by author brandon-arrendondo opened on Sep 15, 2026

• Investigate unnecessary message-layer resets during TLS 1.3 HelloRetryRequest

  priority-highsize-s
  Bug

  Mbed-TLS/mbedtls#10954 · Filter by author ronald-cron-arm opened on Sep 15, 2026
  

• LMS: defensive output zeroization added by 9b3051fb10 covers one of five equivalent call sites

  bugcomponent-cryptopriority-lowsize-s
  Mbed-TLS/mbedtls#10952 · Filter by author 0xiviel opened on Sep 14, 2026

• Rare intermittent failure of "DTLS fragmenting: 3d …" test

  bugcomponent-tls
  Bug

  Mbed-TLS/mbedtls#10937 · Filter by author gilles-peskine-arm opened on Aug 29, 2026

• Upgrade compliance to the new version of the TLS 1.3 standard (RFC 9846)

  component-tls13enhancement
  Mbed-TLS/mbedtls#10931 · Filter by author yanesca opened on Aug 27, 2026

• Test with CMake 3.10.2

  good-first-issueresolved-after-3.6size-xs
  Task

  Mbed-TLS/mbedtls#10930 · Filter by author gilles-peskine-arm opened on Aug 26, 2026
  2

• TLS 1.3 warning-level error alerts are treated as non-fatal

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10924 · Filter by author gilles-peskine-arm opened on Aug 13, 2026

• mbedTLS serializes duplicate supported_groups entries

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10919 · Filter by author LiD0209 opened on Aug 11, 2026

• RFC9846 mbedTLS issue: TLS 1.3 PSK heap copies are freed without zeroization

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10918 · Filter by author LiD0209 opened on Aug 11, 2026
  3

• TLS 1.3 transform setup can leave an imported traffic key undisposed on failure

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10917 · Filter by author LiD0209 opened on Aug 11, 2026
  

• TLS 1.3 application traffic secrets survive public session export after connection teardown

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10916 · Filter by author LiD0209 opened on Aug 11, 2026

• RFC9846 mbedTLS issue: psk_key_exchange_modes accepts trailing extension data

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10915 · Filter by author LiD0209 opened on Aug 11, 2026
  1

• RFC9846 mbedTLS issue: AES-GCM early-data key-usage limit is not enforced

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10914 · Filter by author LiD0209 opened on Aug 11, 2026

• X.509 certificates reference public keys stored in crypto storage

  component-x509enhancementsize-m
  Feature

  Mbed-TLS/mbedtls#10913 · Filter by author ImKrian opened on Aug 10, 2026

• Confirmed interoperability failure on large TLS 1.3 Certificate messages

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10906 · Filter by author LiD0209 opened on Aug 6, 2026

• mbedTLS Client Accepts an Over-Limit NewSessionTicket.extensions Vector

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10907 · Filter by author LiD0209 opened on Aug 6, 2026

• TLS 1.3 Protected CCS Does Not Trigger the RFC-Required Abort

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10901 · Filter by author LiD0209 opened on Aug 6, 2026

• Empty resumption ticket shrinks OfferedPsks.identities below the RFC minimum

  component-tls13
  Bug

  Mbed-TLS/mbedtls#10902 · Filter by author LiD0209 opened on Aug 6, 2026