CVE-2024-28836

An issue exists in Mbed TLS versions 3.5.x before 3.6.0 where the server-side TLS version negotiation can fall back to the TLS 1.2 implementation even if it is disabled. If TLS 1.2 is disabled at build time, a TLS 1.2 client can trigger an infinite loop while processing a ClientHello, leading to ...