PT-2025-48520

Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow...

PT-2025-48522

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service DoS via mbedtls x509 set extension...

PT-2025-48528

Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls asn1 store named data can trigger conflicting data with val.p of NULL but val.len greater than zero...

PT-2025-48529

Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls x509 string to names takes a head argument that is documented as an output argument. The documentation does not suggest that the functi...

PT-2025-48525

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls ssl set hostname...

PT-2025-48515

A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls pkcs12 derivation function when an input password's length is 0...

PT-2025-48510

An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name the cn argument of mbedtls x509 crt verify with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to...

PT-2025-48504

An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator...

PT-2025-48496

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

PT-2025-48497

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks...

PT-2025-48506

An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock...

PT-2025-48505

An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key for RSA or static Diffie-Hellman via a side-channel attack against generation of base blinding/unblinding values...

PT-2025-48502

An issue was discovered in Arm Mbed TLS before 2.23.0. Because of a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed...

PT-2025-48526

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...

PT-2025-48513

In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa cipher generate iv and psa cipher encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...

PT-2025-48517

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...

PT-2025-48523

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory...

PT-2025-48527

Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls pem read buffer and two mbedtls pk parse functions, via untrusted PEM input...

PT-2025-48512

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls ssl set session failure...

PT-2025-48524

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS PSA HMAC DRBG MD TYPE does not cause the PSA subsystem to use HMAC DRBG: it uses HMAC DRBG only when MBEDTLS PSA CRYPTO EXTERNAL...