In Mbed TLS versions >=3.2.0 <3.6.7 and >=4.0.0 <4.1.1, an attacker capable of causing an entropy source failure can manipulate the TLS 1.3 stream by removing or injecting bytes at its start. This vulnerability arises from improper handling of unexpected status codes or return values (CWE-394) in the trustedfirmware Mbed TLS implementation. The flaw specifically affects TLS 1.3 servers.

The vulnerability allows limited integrity impact by enabling an attacker to remove or inject bytes at the beginning of the TLS 1.3 stream. There is no confidentiality or availability impact reported. The CVSS score of 2.9 reflects a low severity with local attack vector, high attack complexity, no privileges required, and no user interaction.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid scenarios where an attacker can cause entropy source failures on TLS 1.3 servers using affected Mbed TLS versions.