{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"mbedtls","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NRSY0VYYJJSD89TWH6RV8X","modified_at":"2026-10-01T03:03:10.737085369Z","published_at":"2026-04-02T17:16:26.927Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-34877","https://security-tracker.debian.org/tracker/CVE-2026-34877"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-34877#Debian:13/mbedtls","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-34877"}],"summary":"An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the seri"}