Mbed TLS -- multiple vulnerabilities

Mbed TLS Team reports:

• CVE-2026-50581: Fix a bug where transcript-hash computation errors during TLS 1.2 extended master secret calculation could be ignored instead of causing the handshake to fail. This could allow a handshake to continue with a master secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret extension.
• CVE-2026-50640: Fix a TLS 1.3 server-side error-handling bug affecting session ticket generation. Under rare conditions, such as memory allocation failures while computing the resumption master secret, the server could issue invalid session tickets instead of failing the handshake. Clients presented with such tickets would fail session resumption and fall back to a full handshake. In deployments relying on session resumption, repeated occurrences could increase the frequency of full handshakes and amplify resource consumption during periods of resource exhaustion or other transient failures.
• CVE-2026-50580: Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled.
• CVE-2026-50586: Fix a potential information disclosure in TLS 1.2 servers using session tickets. If the session ticket write callback failed without setting the lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized stack memory to the peer in the NewSessionTicket message.
• CVE-2026-50588: Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages.
• CVE-2026-50579: Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The function now resets the context after freeing it, ensuring stale signed_data.signers.next pointers cannot be walked by a later free operation.
• CVE-2026-54441: Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during TLS key exchange and not on certificate verification.
• CVE-2026-50585 : Ensure 'badmac_seen' and 'dtls_srtp_info' fields from 'mbedtls_ssl_context' are properly zeroized when mbedtls_ssl_session_reset() is called. This could cause premature DTLS connection failure or incorrect DTLS-SRTP parameter inheritance for applications reusing an SSL context.
• CVE-2026-25832: Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello.
• CVE-2026-49300: Fix two bugs in the X.509 certificate parser that caused some inputs with a malformed basicConstraints extension to be accepted. This could have dangerous results, in particular causing some certificates to be parsed as CA certificates when other X.509 implementations would parse them as end-entity certificates.

[source]