All pull requests

Pull requests

• Fix TLS 1.3 handshakes with opaque PSKs

  bugcomponent-tls13size-s
  #10967·v1rtu3x opened Sep 23, 2026·

  ·
  1

• Fix resource leak in populate transform 3.6 backport

  needs-reviewneeds-reviewerpriority-highsize-s
  #10966·bjwtaylor opened Sep 23, 2026Contributor·

  ·

• Fix resource leak in populate transform 4.1 backport

  needs-reviewneeds-reviewerpriority-highsize-s
  #10965·bjwtaylor opened Sep 23, 2026Contributor·

  ·

• Validate timestamps in mbedtls_x509write_crt_set_validity

  component-x509enhancementneeds-cipriority-mediumsize-s
  #10959·nvxbug opened Sep 20, 2026Contributor·

  ·
  1

• Use relative URLs for the framework and tf-psa-crypto submodules

  needs-cineeds-design-approvalneeds-reviewneeds-reviewerpriority-lowsize-xs
  #10953·parmi93 opened Sep 15, 2026·

  ·
  2

• Add MBEDTLS_SSL_RUNTIME_CONTENT_LEN and per-connection content lengths

  component-tlsenhancementneeds-cineeds-reviewneeds-reviewerneeds-workpriority-lowsize-msize-s
  #10951·barakgut opened Sep 11, 2026·

  ·
  1

  4

• Fix a build error in the full config on some C23 platforms

  bugneeds-reviewneeds-reviewerpriority-mediumsize-xs
  #10950·gilles-peskine-arm opened Sep 9, 2026Contributor·

  ·

• Fix NULL dereference in DTLS keying material export

  #10946·pdgendt opened Sep 8, 2026·

  ·
  3

  

• PKCS#7: Embedded certificate support and chain verification

  component-x509enhancementneeds-cineeds-preceding-prpriority-mediumsize-s
  #10941·sridhar-design opened Sep 2, 2026·

  ·
  1

• Fix X.509 certificate profiles to honor MBEDTLS_PK_SIGALG_ECDSA

  bugcomponent-x509needs-backportsneeds-reviewneeds-reviewerpriority-mediumsize-s
  #10936·v1rtu3x opened Aug 28, 2026·

  ·
  2

  2

• tls13: server: reject zero-length psk_key_exchange_modes

  bugcomponent-tls13needs-reviewneeds-reviewerpriority-mediumsize-xs
  #10934·v1rtu3x opened Aug 27, 2026·

  ·
  1

  2

• Fix PSA initialisation in client fuzzers

  bugcomponent-testneeds-cineeds-workpriority-mediumsize-xs
  #10932·JulioLoayzaM opened Aug 27, 2026·

  ·

• Backport 4.1: Fix off-by-one over-read in TLS 1.2 ClientHello and CertificateRequest

  component-tlsneeds-reviewpriority-mediumsize-xs
  #10929·nvxbug opened Aug 24, 2026Contributor·

  ·
  1

• Backport 3.6: Fix off-by-one over-read in TLS 1.2 ClientHello and CertificateRequest

  component-tlsneeds-reviewpriority-mediumsize-xs
  #10928·nvxbug opened Aug 24, 2026Contributor·

  ·
  1

• Fix resource leak in populate transform

  needs-backportsneeds-reviewneeds-reviewerpriority-highsize-s
  #10926·bjwtaylor opened Aug 20, 2026Contributor·

  ·
  1

  13

• Reject overflowing numeric OID components

  component-x509needs-reviewneeds-reviewerpriority-mediumsize-xs
  #10911·subotac opened Aug 10, 2026·

  ·
  1

  1

• ssl_fork_server RNG testing

  component-tlsneeds-backportsneeds-reviewpriority-highsize-s
  #10861·gilles-peskine-arm opened Aug 6, 2026Contributor·

  ·
  1

  5

• Backport 4.1: ssl_fork_server RNG testing

  component-tlsneeds-reviewpriority-highsize-s
  #10858·gilles-peskine-arm opened Aug 5, 2026Contributor·

  ·
  3

• new and expanded fuzzing harnesses

  component-testenhancementneeds-cipriority-mediumsize-m
  #10857·vanhauser-thc opened Aug 5, 2026·

  ·
  1

• PKCS5 simplify deps on MBEDTLS_CIPHER_PADDING_PKCS7 + PKCS12 remove test exceptions

  needs-backportsneeds-preceding-prneeds-reviewneeds-reviewerpriority-highsize-xs
  #10855·valeriosetti opened Aug 4, 2026Contributor·

  ·
  1

• Fix buffer overreads on malformed inputs in sample programs

  bugcomponent-tlspriority-mediumsize-xs
  #10852·felipereyesmurcia opened Aug 3, 2026·

  ·
  1

  1

• 3.6 only: Fix possible miscompilation of ssl_hostname_skip_cn_verification hack

  bugcomponent-tlsneeds-reviewneeds-reviewerpriority-mediumsize-xs
  #10843·gilles-peskine-arm opened Jul 23, 2026Contributor·

  ·

• Backport v3.6: Fix IAR endianness detection in alignment.h

  needs-backportsneeds-reviewneeds-reviewerpriority-mediumsize-xs
  #10840·nzzlinh opened Jul 23, 2026·

  ·
  3

  

• x509:reject certificates with a zero serial number (RFC 5280)

  #10839·dwivedys opened Jul 21, 2026·

  ·
  1

  2

  

• Fix off-by-one over-read in TLS 1.2 ClientHello and CertificateRequest

  approvedcomponent-tlsneeds-backportspriority-mediumsize-xs
  #10833·nvxbug opened Jul 15, 2026Contributor·

  ·
  28