{
  "fix": "DEBIAN-CVE-2026-73064",
  "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-73064",
  "summary": "DEBIAN-CVE-2026-73064, released September 26, 2026, fixes 1 CVE in mbedtls (version 3.6.7-1). None of them is reported as exploited. Patch Radar priority: Routine.",
  "platform": "linux",
  "type": "advisory",
  "title": "mbedtls security update",
  "released": "2026-09-26T19:52:05Z",
  "priority": "Routine",
  "priorityTier": 4,
  "priorityReason": "Closes CVE-2026-73064",
  "supported": true,
  "cveCount": 1,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.00103,
  "maxCvss": 2.9,
  "vendorAdvisory": "https://security-tracker.debian.org/tracker/CVE-2026-73064",
  "appliesTo": [
    {
      "product": "mbedtls",
      "productUrl": "https://patchblox.com/security/product/linux/mbedtls",
      "release": "Debian 14",
      "fixedVersion": "3.6.7-1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-73064",
      "url": "https://patchblox.com/security/cve/CVE-2026-73064",
      "title": "In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.",
      "priority": "Routine",
      "severity": "Low",
      "cvss": 2.9,
      "epss": 0.00103,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}