Re: MbedTLS X.509 Basic Constraints Extension Issue (was: Re: Security Contact for mbedtls?) - mbed-tls

19 Aug 2026


      Hello again,
Looking at the content of the issue, it is one of the two bugs in 
basicConstraints parsing covered by CVE-2026-49300, which we fixed in 
our July release.
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-securi...
I can add you as an independent reporter to the credits list. Let me 
know how you'd like to be acknowledged.
-- 
Best regards,

Gilles Peskine

On 19/08/2026 10:15, Maximilian Radoy wrote:
>
> Dear Gilles Peskine,
>
> we are trying to get in contact with 
> mbed-tls-security@lists.trustedfirmware.org for almost three months 
> now regarding a security-relevant finding in mbedtls, but we do not 
> get any response at all.
>
> As you seem to be (according to github) actively involved in that 
> project, we'd like to ask you whether there are any alternative ways 
> to deliver our security report? Otherwise, we may post it as regular 
> github issue.
>
> Thank you in advance for your help!
>
> Best regards,
> Maximilian Radoy
>
> -- 
>
> *Maximilian Radoy*
> Research Assistant
> System Security Group
> Paderborn University
> Universität Paderborn https://www.uni-paderborn.de/en
> Fürstenallee 11
> 33102 Paderborn
> Germany
> *Office* F2.308
> *Telephone* +49 5251 60-6724
> *E-Mail* maximilian.radoy@uni-paderborn.de
>
>
> Instagram https://www.instagram.com/uni_paderborn/ Facebook 
> https://www.facebook.com/unipaderborn LinkedIn 
> https://de.linkedin.com/school/uni-paderborn/ YouTube 
> https://www.youtube.com/user/upbvideo
>