Mbed TLS versions prior to 3.6.4 contain a race condition in AESNI detection triggered by certain compiler optimizations. This flaw can allow an attacker to extract AES encryption keys from multithreaded applications or perform forgery attacks on GCM mode encryption.