CVE-2025-27809

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtlssslsethostname...

CVE-2025-27810

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays...

CVE-2025-27809

MBed TLS vulnerability CVE-2025-27809 affects client-side TLS: versions before 2.28.10 and 3.x before 3.6.3 accept servers with trusted certificates for arbitrary hostnames unless the TLS client calls mbedtls_ssl_set_hostname. This can enable hostname validation bypass on affected clients. Connec...

PT-2025-12764

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x through 2.28.9 Mbed TLS versions 3.x through 3.6.2 Description The issue allows servers with trusted certificates for arbitrary hostnames to be accepted by the client unless the TLS client application calls mbedtls ssl se...

PT-2025-12765

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.28.9 and earlier, 3.x versions prior to 3.6.3 Description The issue arises when Mbed TLS, in certain cases of failed memory allocation or hardware errors, utilizes uninitialized stack memory to compose the TLS Finished...

Linux Distros Unpatched Vulnerability : CVE-2024-28960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory...

Linux Distros Unpatched Vulnerability : CVE-2021-44732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtlssslsetsession failure. CVE-2021-44732 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2021-36647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11...

Linux Distros Unpatched Vulnerability : CVE-2022-46392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, ...

Linux Distros Unpatched Vulnerability : CVE-2022-35409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello...

Linux Distros Unpatched Vulnerability : CVE-2024-23170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could b...

Linux Distros Unpatched Vulnerability : CVE-2024-23775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service DoS via mbedtlsx509setextension...

Linux Distros Unpatched Vulnerability : CVE-2024-28755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtlssslsessionreset API, the maximum TLS version to be...

PT-2025-30210

Name of the Vulnerable Software and Affected Versions mbedtls versions prior to 3.6.4 Description The software contains a NULL pointer dereference issue in the mbedtls asn1 store named data function. This occurs when conflicting data is triggered with val.p being NULL but val.len being greater th...

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0 and Mbed Crypto. The PSA Crypto API mishandles shared memory.

...

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations.

...

Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.

...

CBL Mariner 2.0 Security Update: hvloader (CVE-2024-23744)

The version of hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23744 advisory. - An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1....

CBL Mariner 2.0 Security Update: hvloader (CVE-2024-23775)

The version of hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23775 advisory. - Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cau...

CBL Mariner 2.0 Security Update: hvloader (CVE-2024-45159)

The version of hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45159 advisory. - An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional...