CVE-2026-1677 net: TLS 1.2 connections allowed on TLS 1.3 sockets

What is CVE-2026-1677?

CVE-2026-1677 is a medium-severity vulnerability in Zephyrproject Zephyr, published on 11 May 2026.

Official description

Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses. As a workaround, the `TLS_CIPHERSUITE_LIST` socket option can be restricted to TLS 1.3-only cipher suites.

Weakness: CWE-757

Which versions are affected by CVE-2026-1677?

It affects 1 product.

Products include Zephyrproject Zephyr.

How do I fix CVE-2026-1677?

No fix has been published for CVE-2026-1677 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-1677 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1677 exists.

Other vulnerabilities in Zephyrproject Zephyr

• CVE-2026-5067 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key Critical 9.8
• CVE-2022-3806 Bluetooth HCI Error Handling Double Free Critical 9.8
• CVE-2017-14199 Memory corruption in getaddrinfo Critical 9.8
• CVE-2018-1000800 Null dereference in n/a Critical 9.8
• CVE-2021-3329 DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer Critical 9.6

All Zephyrproject Zephyr vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-23r2-m5wx-4rvq.