CVE-2024-28755

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

• CWE-326

• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0Release Notes
• https://github.com/hey3eNot Applicable
• https://hey3e.github.ioNot Applicable
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/Vendor Advisory
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0Release Notes
• https://github.com/hey3eNot Applicable
• https://hey3e.github.ioNot Applicable
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/Vendor Advisory

Published

Apr 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2875Rejected reason: ** REJECT ** Duplicate reservation. Please …
• CVE-2024-28750A remote attacker with high privileges may use a deleting fi…7.2
• CVE-2024-28751An high privileged remote attacker can enable telnet access …9.1
• CVE-2024-28752A SSRF vulnerability using the Aegis DataBinding in versions…9.3
• CVE-2024-28753RaspAP (aka raspap-webgui) through 3.0.9 allows remote attac…6.5
• CVE-2024-28754RaspAP (aka raspap-webgui) through 3.0.9 allows remote attac…7.5
• CVE-2024-28756The SolarEdge mySolarEdge application before 2.20.1 for Andr…5.9
• CVE-2024-28757libexpat through 2.6.1 allows an XML Entity Expansion attack…7.5
• CVE-2024-28759A crafted network packet may cause a buffer overrun in Wind …4.3
• CVE-2024-2876The Email Subscribers by Icegram Express – Email Marketing, …9.8
• CVE-2024-28760IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12…4.3
• CVE-2024-28761IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12…5.4