(blog.quarkslab.com) Security Audit of mbedTLS 4.0: Architectural Changes, Vulnerabilities, and Recommendations In brief - This article describes a security audit performed by Quarkslab on mbedTLS version 4.0, commissioned by the Open Source Technology Improvement Fund (OSTIF). The audit focused on the security implications of the library's major architectural transition and the integration of the TF-PSA-Crypto library. Technically - This article details an assessment of the architectural split between the TLS/X.509 layer and the new TF-PSA-Crypto standalone library, which implements the PSA Cryptography API v1.2. The audit evaluated the trust boundary, memory safety in SSL/DTLS context management, and compliance with TLS 1.2, 1.3, and DTLS specifications. Key findings included a high-severity heap buffer overflow in `mbedtls_ssl_context_load()`, a low-severity issue regarding BER-encoded signature acceptance in `mbedtls_pk_verify()`, and a lack of anti-replay protection for TLS 1.3 0-RTT early data. Source: http://blog.quarkslab.com/mbedtls-security-audit.html #Cybersecurity