mbed-tls August 2026

mbed-tls@lists.trustedfirmware.org

3 participants
3 discussions

Re: MbedTLS X.509 Basic Constraints Extension Issue (was: Re: Security Contact for mbedtls?)

by Gilles Peskine

Hello again, Looking at the content of the issue, it is one of the two bugs in basicConstraints parsing covered by CVE-2026-49300, which we fixed in our July release. https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-secur… I can add you as an independent reporter to the credits list. Let me know how you'd like to be acknowledged. -- Best regards, Gilles Peskine On 19/08/2026 10:15, Maximilian Radoy wrote: > > Dear Gilles Peskine, > > we are trying to get in contact with > mbed-tls-security(a)lists.trustedfirmware.org for almost three months > now regarding a security-relevant finding in mbedtls, but we do not > get any response at all. > > As you seem to be (according to github) actively involved in that > project, we'd like to ask you whether there are any alternative ways > to deliver our security report? Otherwise, we may post it as regular > github issue. > > Thank you in advance for your help! > > Best regards, > Maximilian Radoy > > -- > > *Maximilian Radoy* > Research Assistant > System Security Group > Paderborn University > Universität Paderborn <https://www.uni-paderborn.de/en> > Fürstenallee 11 > 33102 Paderborn > Germany > *Office* F2.308 > *Telephone* +49 5251 60-6724 > *E-Mail* maximilian.radoy(a)uni-paderborn.de > > > Instagram <https://www.instagram.com/uni_paderborn/> Facebook > <https://www.facebook.com/unipaderborn> LinkedIn > <https://de.linkedin.com/school/uni-paderborn/> YouTube > <https://www.youtube.com/user/upbvideo> >

3 days, 12 hours

DTLS 1.3 contribution

by Yaron Sheffer

[Apologies, resending as text] Hi, I've been working on an implementation of DTLS 1.3 in Mbed TLS, basically as a side project. For transparency, I have used AI heavily in this work, but I am fully accountable for the code. Obviously, this is a large quantity of code. I would appreciate your feedback on the following plan [1]: I could break the contribution into 7-8 PRs (first PR about 1k LOC, largest PR 5-6K). I would ensure from day one that the new functionality remains off by default and avoid any changes to existing TLS and DTLS 1.2 behavior. Then we could have users try it out for a while as opt-in, and only then the project team can decide to enable it by default. The code base is available as a branch [2] and is accompanied by copious documentation [3]. Recently I updated the code in line with both 4.2.0 of this library and the new version -02 of the rfc9147bis Internet Draft. The code includes unit tests, integration tests and interoperability testing with wolfSSL. I have also run multiple security reviews of the code and reviewed it manually, and I'm ready to iterate as needed to follow the project's processes. If you are open to this plan, I will open a tracking issue right away and follow with smallish PR1. Looking forward to contributing to this community! Thanks, Yaron [1] https://github.com/yaronf/mbedtls/blob/dtls13/local-docs/upstream-dtls13-pr… [2] https://github.com/yaronf/mbedtls/tree/dtls13 [3] https://github.com/yaronf/mbedtls/tree/dtls13/local-docs

2 weeks, 1 day

DTLS 1.3 contribution

by Yaron Sheffer

2 weeks, 5 days

2026

2025

2024

2023

2022

2021

2020

mbed-tls August 2026