CVE-2026-25834 describes an algorithm downgrade vulnerability in Mbed TLS versions 3.3.0 through 3.6.5 and 4.0.0. This vulnerability allows an attacker to influence the cryptographic negotiation process to select weaker algorithms than intended, potentially reducing the security of the TLS connection. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but low integrity and availability impacts. The vulnerability is categorized under CWE-295 (Improper Certificate Validation) and CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). No patch or remediation information is currently provided.

The vulnerability could allow an attacker to downgrade the cryptographic algorithms used in TLS connections, potentially weakening the security guarantees of the communication channel. This may lead to reduced integrity and availability of the affected service. There is no reported confidentiality impact. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided in the available data.