Micropython currently pulls in Mbed TLS at commit https://github.com/ARMmbed/mbedtls/tree/1bc2c9cb8b8fe4659bd94b8ebba5a4c02029b7fa which is from the Mbed TLS 2.16 branch. Support for Mbed TLS 2.16 ended in January 2022. An old branch of a security library is very likely to have known vulnerabilities.

Please upgrade to a maintained version of Mbed TLS. At the moment, the choices are:

• mbedtls-2.28 — long-time support branch, only getting bug fixes. We plan to support this branch until December 2024. APIs are fully compatible with 2.16.
• development — development branch, with new features (which can mean an increase in code size). This is a new major version of Mbed TLS (3.x series) compared to the current one, so some application code may need to be rewritten due to API changes.

Furthermore, in the future, to avoid shipping software that embeds a library version which may have known vulnerabilities, please upgrade Mbed TLS regularly. Releases ship through GitHub and are announced on the mbed-tls-announce mailing list.