How severe is CVE-2026-1677?

CVE-2026-1677 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-1677 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-1677?

CVE-2026-1677 affects Zephyrproject Zephyr. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-1677?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-1677 have an EU (EUVD) identifier?

Yes. CVE-2026-1677 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29033.

When was CVE-2026-1677 published?

CVE-2026-1677 was published on 2026-05-11 and last updated on 2026-07-08.

CVE-2026-1677

CVE-2026-1677 is a medium-severity vulnerability in Zephyrproject Zephyr with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-757.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (10th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-29033
Weakness: CWE-757
Affected product: Zephyrproject Zephyr
Published: 2026-05-11
Last modified: 2026-07-08

Description

Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses. As a workaround, the `TLS_CIPHERSUITE_LIST` socket option can be restricted to TLS 1.3-only cipher suites.

Frequently asked questions

What is CVE-2026-1677?: Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses. As a workaround, the `TLS_CIPHERSUITE_LIST` socket option can be restricted to TLS 1.3-only cipher suites.
How severe is CVE-2026-1677?: CVE-2026-1677 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-1677 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-1677?: CVE-2026-1677 affects Zephyrproject Zephyr. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-1677?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-1677 have an EU (EUVD) identifier?: Yes. CVE-2026-1677 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29033.
When was CVE-2026-1677 published?: CVE-2026-1677 was published on 2026-05-11 and last updated on 2026-07-08.

References

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-23r2-m5wx-4rvq

Affected products (1)

cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

More vulnerabilities in Zephyrproject Zephyr

CVE-2026-5067 — Critical (CVSS 9.8): A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by…
CVE-2022-3806 — Critical (CVSS 9.8): Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
CVE-2017-14199 — Critical (CVSS 9.8): A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.
CVE-2018-1000800 — Critical (CVSS 9.8): zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(),…
CVE-2021-3329 — Critical (CVSS 9.6): Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
CVE-2023-0397 — Critical (CVSS 9.6): A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in…

All CVEs affecting Zephyrproject Zephyr →

Other CWE-757 vulnerabilities

CVE-2024-4995 — Critical (CVSS 9.8): Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an…
CVE-2024-38883 — Critical (CVSS 9.1): An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions,…
CVE-2019-14887 — Critical (CVSS 9.1): A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly…
CVE-2024-8773 — High (CVSS 8.3): SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an…
CVE-2018-25029 — High (CVSS 8.1): The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an…
CVE-2025-10693 — High (CVSS 7.6): When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a…

Browse all CWE-757 vulnerabilities →