MbedTLS Security Audit

2026-10-20T00:00:00+02:00

Introduction

Mbed TLS is a widely deployed open-source TLS, DTLS, and X.509 library maintained by Trusted Firmware, targeting constrained and embedded environments. It is used as the cryptographic backbone of products across the IoT, automotive, and industrial sectors, and forms the TLS layer for projects such as the Trusted Firmware family.

Version 4.0 represents the most significant architectural change in the project's history. The cryptographic layer has been extracted into a standalone library, TF-PSA-Crypto, which implements the PSA Cryptography API v1.2 as specified by Arm. The Mbed TLS repository now consumes TF-PSA-Crypto as a submodule, and the configuration space has been split across two header files: mbedtls_config.h for the TLS and X.509 options, and psa/crypto_config.h for the cryptographic primitives. All RNG callbacks have been removed in favor of a mandatory call to psa_crypto_init() before any operation.

The Open Source Technology Improvement Fund (OSTIF) commissioned Quarkslab to perform a security audit of this new architecture.

Scope

The primary objectives of this audit are:

Architectural transition review. Assess the security implications of the Mbed TLS 3.x to 4.0 split, focusing on the trust boundary between the TLS layer and TF-PSA-Crypto, the correctness of the PSA API integration, and whether the removal of the legacy crypto paths introduces new attack surface.
PSA API usage correctness. Verify that key attributes (usage flags, permitted algorithms, lifetimes) are correctly set and enforced throughout the TLS and X.509 code paths, and that the mandatory psa_crypto_init() dependency is properly documented and enforced.
Memory safety. Identify memory corruption vulnerabilities in the SSL/DTLS context management (in particular, session serialization and resumption), the X.509 parsing subsystem, and the PSA key store.
Default configuration posture. Review the security of the default build configuration, including enabled cipher suites, protocol versions, key exchange algorithms, and compile-time options that may expose users to risk without explicit opt-in.
Protocol compliance. Identify deviations from the TLS 1.2 (RFC 5246), TLS 1.3 (RFC 8446), and DTLS specifications that have security consequences.

The engagement covers:

Mbed TLS at commit 0fe989b6b514192783c469039edd325fd0989806.
TF-PSA-Crypto (integrated submodule) at commit 29160dd877d29658279fd683b2ae57b320ddcf09.

The complete technical report, including our findings and recommendations, is available in Quarkslab's public reports repository.

Findings

The table below summarizes the findings of the audit. A total of 5 vulnerabilities were identified: 1 of high severity, 1 of low severity, and 3 informational ones.

ID	Title	Severity	Perimeter
HIGH-1	CID Buffer Overflow in `mbedtls_ssl_context_load()`	High	`library/ssl_tls.c:5002`
LOW-4	`mbedtls_pk_verify()` accepts BER-encoded signatures	Low	`tf-psa-crypto/extras/pk.c`
INFO-2	No Anti-Replay Protection for TLS 1.3 0-RTT Early Data	Info	`include/mbedtls/ssl.h:5166`
INFO-3	Mismatch in CMAC cipher support between the documentation and the implementation.	Info	TF-PSA-Crypto documentation
INFO-5	`compat.sh` DTLS 1.2 tests fail on the `mbedtls-test` Docker image due to IPv6 `localhost` resolution	Info	mbedtls-test Docker images, `compat.sh`

Note: All relevant findings have since been resolved.

Conclusion

The audit identified a few vulnerabilities with only two non-informational ones, and the auditors were overall very satisfied with the quality of the product in general, and this version's changes in particular.

The high and low vulnerabilities are related to a heap buffer overflow and potential signature malleability, respectively, with the second one being identified thanks to the integration of integration of Project Wycheproof test vectors into the test suite.

An informational finding documents the absence of any anti-replay protection for TLS 1.3 0-RTT early data, a known limitation that is currently not surfaced in the public-facing documentation in a way that prevents inadvertent misuse. Auditors have proposed improvements to the existing fuzzing harnesses and corpora, along with an integration of the #anv test suite into the CI/CD pipeline.

We would like to thank the Mbed TLS maintainers for their responsiveness and collaboration throughout the audit process, as well as the OSTIF team for their continuous support.

Further details can be found in our report.

Quarkslab's blog - mbedtls

MbedTLS Security Audit

Introduction

Scope

Findings

Conclusion

Further reading