CVE-2025-11935
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
With TLS 1.3 pre-shared key (PSK), a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue the connection using PSK without PFS. This occurs when a server responds to a ClientHello containing psk_dhe_ke without a key_share extension, reducing connection security.
Risk Assessment
Re-use of an authenticated PSK connection without PFS on the client side weakens session confidentiality — captured data may be decrypted if the key is later compromised. The risk affects TLS 1.3 clients using PSK.
Recommendation
Update the TLS library to a patched version and consider enforcing PFS in PSK connection configurations. Monitor connections to servers that do not negotiate key_share.
Other vulnerabilities in TLS 1.3
See all- CVE-2025-61730Medium
During the TLS 1.3 handshake, if multiple messages are sent in records that span encryption level boundaries (e.g., Client Hello and Encrypted Extensions), subsequent messages may be processed before the encryption level changes. This can cause minor information disclosure.
- CVE-2026-101302Medium
In TLS 1.3, the actual record type is embedded as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).
- CVE-2026-6860Medium
A TCP client can perform a TLS handshake and present the server name extension with a server name accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where XYZ is a valid name can be used. The description does not identify a specific product or version.
- CVE-2026-32283High
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled resource consumption. This leads to denial of service. This only affects TLS 1.3.
- CVE-2025-12889Medium
With TLS 1.2 connections, a client can use any supported digest, including a weaker one, instead of those specified in the CertificateRequest. This may weaken the security of the connection handshake.
Original NVD description (English source)
With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS