CVE-2022-46392

CVE-2022-46392 affects Mbed TLS 2.28.2 and 3.x prior to 3.3.0. An adversary with precise memory-access information (e.g., untrusted OS vs. secure enclave) can recover an RSA private key after a single private-key operation when MBEDTLS_MPI_WINDOW_SIZE is 3 or smaller. Debian/Siemens and related a...

CVE-2018-0497

CVE-2018-0497 affects ARM mbed TLS prior to 2.12.0, prior to 2.7.5, and prior to 2.1.14. It enables remote partial plaintext recovery in CBC-based ciphersuites via a timing-based side-channel attack. The issue stems from an incorrect fix for CVE-2013-0169, specifically a wrong SHA-384 calculation...

CVE-2021-36647

The issue (CVE-2021-36647) is in the mbed TLS library, specifically the function mbedtls_mpi_exp_mod() in lignum.c. All affected releases prior to 3.0.0, 2.27.0, or 2.16.11 are vulnerable. The underlying problem is the use of a broken or risky cryptographic algorithm that, when an attacker has pr...

CVE-2019-18222

CVE-2019-18222 affects Arm Mbed Crypto 2.1 and Mbed TLS up to 2.19.1: the ECDSA implementation in ecdsa.c does not reduce the blinded scalar before the inverse, enabling local side-channel attacks to recover the private key. Several advisories report upstream fixes (e.g., 2.20.0, 3.0.1) and packa...

CVE-2021-24119

CVE-2021-24119 affects Trusted Firmware Mbed TLS 2.24.0, where a side-channel in base64 PEM decoding could let system-level attackers (e.g., with admin rights) glean information about secret RSA keys via a controlled-channel/side-channel in isolated environments (notably SGX). Connected advisorie...

CVE-2018-0498

mbed TLS (ARM PolarSSL) vulnerability CVE-2018-0498 affects CBC-based ciphersuites and allows partial plaintext recovery via a cache-based side-channel attack. Affected versions are before 2.12.0, before 2.7.5, and before 2.1.14. Remediation is to upgrade to patched releases (e.g., 2.12.0+ and ne...

CVE-2021-44732

CVE-2021-44732 affects MBed TLS before 3.0.1, with a double free in certain out-of-memory conditions triggered by mbedtls_ssl_set_session(). The issue is documented across several advisories (Debian, Mageia, Gentoo, Astra Linux) and is fixed in newer releases (e.g., MBed TLS 3.0.1+; Debian 2.16.9...

CVE-2019-16910

Arm Mbed TLS prior to 2.19.0 and Arm Mbed Crypto prior to 2.0.0 are affected by CVE-2019-16910. When deterministic ECDSA is enabled, the RNG blinding uses insufficient entropy, enabling a side-channel based attack that could recover a private key if the same message is signed repeatedly. The issu...

CVE-2022-35409

Mbed TLS DTLS heap over-read CVE-2022-35409: unauthenticated clients can send a malformed ClientHello to a DTLS server with MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN below a config-dependent threshold, causing a heap-based over-read of up to 255 bytes and possibly ...

CVE-2023-52353

CVE-2023-52353 affects Mbed TLS up to version 3.5.1, where in mbedtls_ssl_session_reset the maximum negotiable TLS version can be reduced to the last used version (e.g., TLS 1.2) and thus mishandled. This can impact integrity for negotiated sessions by enabling downgrade-like behavior. Public ref...

CVE-2020-16150

CVE-2020-16150 describes a Lucky 13 timing side-channel in mbedtls_ssl_decrypt_buf (library/ssl_msg.c) of Trusted Firmware Mbed TLS up to version 2.23.0. The side-channel arises from padding-length dependent timing in CBC mode, enabling an attacker to recover secret key information. The vulnerabi...

CVE-2017-18187

CVE-2017-18187 affects mbed TLS ( PolarSSL ) prior to 2.7.0. The issue is a bounds-check bypass caused by an integer overflow in ssl_parse_client_psk_identity() within library/ssl_srv.c. Public advisories in Debian/ Gentoo/ Ubuntu describe the impact as remote code execution or denial of service ...

CVE-2022-46393

CVE-2022-46393 affects MBEDTLS DTLS in MBEDTLS_SSL_DTLS_CONNECTION_ID when MBEDTLS_SSL_CID_IN_LEN_MAX > 2 × MBEDTLS_SSL_CID_OUT_LEN_MAX. This can cause a heap-based buffer overflow or over-read. Public detail: vulnerable in MBed TLS < 2.28.2 and

CVE-2020-36478

CVE-2020-36478 affects Mbed TLS up to versions preceding 2.25.0 (and the LTS lines 2.16.9 and 2.7.18). The issue: a NULL algorithm parameters entry can look identical to an empty REAL array, causing a certificate to be treated as valid even when parameters do not match. If parameters do not match...

CVE-2020-36475

The CVE-2020-36475 issue affects Mbed TLS prior to 2.25.0 (and <2.16.9 LTS,

CVE-2025-27809

MBed TLS vulnerability CVE-2025-27809 affects client-side TLS: versions before 2.28.10 and 3.x before 3.6.3 accept servers with trusted certificates for arbitrary hostnames unless the TLS client calls mbedtls_ssl_set_hostname. This can enable hostname validation bypass on affected clients. Connec...

CVE-2020-10941

Summary: CVE-2020-10941 affects Arm Mbed TLS before 2.16.5, where an attacker could recover an RSA private key by measuring cache usage during import. The connected advisories confirm updated packages (e.g., 2.16.7) across distributions (e.g., Fedora/Debian), indicating remediation by upgrading t...

CVE-2020-36425

Arm Mbed TLS before 2.24.0 contains a revocation check flaw for CRLs: it inconsistently honors revocation via CRL by using a revocationDate check, which can be exploited by altering the local clock. This can affect certificate revocation handling. Remediation is to upgrade to version 2.24.0 or la...

CVE-2020-36421

CVE-2020-36421 affects Arm Mbed TLS up to version 2.22.x (before 2.23.0). A side-channel in modular exponentiation could disclose an RSA private key used in a secure enclave, causing partial confidentiality loss of the key material. The vulnerability is documented across multiple sources (e.g., A...

CVE-2021-45451

CVE-2021-45451 affects Mbed TLS prior to 3.1.0. The flaw is in psa_aead_generate_nonce, which can enable policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted app. The vulnerability is tied to how nonces are generated for AEAD operations...

CVE-2025-52496

CVE-2025-52496 affects Mbed TLS prior to 3.6.4. The issue is a race condition during AES-NI detection triggered by certain compiler optimizations, enabling an attacker to either extract an AES key from a multithreaded process or perform a GCM forgery. Affected component: mbedtls library AESNI det...

CVE-2020-36476

CVE-2020-36476 affects Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). The issue is a missing zeroization of plaintext buffers in the TLS code path (mbedtls_ssl_read), which leaves unused application data in memory. Exploitation would rely on memory exposure and could enable...

CVE-2025-27810

CVE-2025-27810 affects Mbed TLS prior to 2.28.10 and 3.x prior to 3.6.3. In some failed memory allocation or hardware error scenarios, the library may use uninitialized stack memory to compose the TLS Finished message, potentially enabling authentication bypasses such as replays. Impact is descri...

CVE-2018-9989

CVE-2018-9989 affects ARM mbed TLS pre-2.1.11, pre-2.7.2, and pre-2.8.0, with a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input. The issue is documented across multiple advisories; Debian LTS/DLA-2826 notes fixes in mbedtls 2.4.2-1+deb9u4 for Debian 9, an...

CVE-2018-9988

CVE-2018-9988 affects ARM mbed TLS prior to 2.1.11, 2.7.2, and 2.8.0, with a buffer over-read in ssl_parse_server_key_exchange that could cause a crash on invalid input. Public-branch fixes exist in newer mbed TLS releases, and downstream advisories (e.g., Debian DLA-2826-1) note updates to mitig...

CVE-2020-36422

CVE-2020-36422 affects Arm Mbed TLS before 2.23.0. A side-channel leaks ECC private keys via operations tied to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable, enabling key recovery. Exploitation details are not provide...

CVE-2020-36423

CVE-2020-36423 affects Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext due to a Lucky 13 timing side-channel not properly handling the case of a hardware accelerator. This is documented in multiple sources referencing Mbed TLS 2.23.0 fixes. Impact is plaintext exposure via net...

CVE-2020-36424

CVE-2020-36424 affects Arm Mbed TLS up to version 2.24.0. A side-channel during the generation of base blinding/unblinding values can allow an attacker to recover a private key (RSA or static DH). The issue is reported across multiple advisories (Astra Linux, GLSA-202301-08, Debian DLA-3249, CNVD...

CVE-2020-36477

CVE-2020-36477 affects Mbed TLS up to version 2.24.0. The issue: when verifying X.509 certificates, the expected name is incorrectly compared to any name in the subjectAltName extension, regardless of type. This enables an attacker to impersonate a 4-byte or 16-byte domain by obtaining a certific...

CVE-2020-36426

An explicit technical detail: CVE-2020-36426 affects Arm Mbed TLS prior to 2.24.0, where mbedtls_x509_crl_parse_der has a one-byte buffer over-read. The connected documents corroborate this in multiple advisories (e.g., GLSA-202301-08 and Debian DLA/Debian advisories) and note a fixed release in ...

CVE-2025-47917

CVE-2025-47917 concerns Mbed TLS prior to 3.6.4. The issue is a use-after-free: mbedtls_x509_string_to_names() takes a head argument documented as output, but the function calls mbedtls_asn1_free_named_data_list() on that argument, freeing memory that the application may still reference. This can...

CVE-2025-48965

The CVE-2025-48965 issue affects Mbed TLS prior to 3.6.4, where the handling of val.p/val.len in mbedtls_asn1_store_named_data can lead to a NULL pointer dereference when val.len > 0. Public documents confirm the vulnerability in mbedtls and indicate fixes/patches in multiple advisories. Debia...

CVE-2025-54764

CVE-2025-54764 affects Mbed TLS up to 3.6.4. The vulnerability is a local timing attack on certain RSA operations and on direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. Affected component: Mbed TLS RSA-related routines. Root cause: timing side-channel in RSA-related MPI operations. Impact...

CVE-2025-52497

CVE-2025-52497 affects Mbed TLS before 3.6.4. The issue is a one-byte heap-based buffer underflow in PEM parsing (mbedtls_pem_read_buffer) and in two mbedtls_pk_parse functions when handling untrusted PEM input. Base CVSS v3.1 score is 4.8 (Network attack, High complexity, No privileges, No user ...

CVE-2025-59438

CVE-2025-59438 affects Mbed TLS up to version 3.6.4, describing an observable timing discrepancy in the library. Multiple connected advisories indicate the issue is addressed by upgrading to 3.6.5 (e.g., Fedora 43/Fedora 43 backports, openSUSE SUSE advisories), with references noting the fix as p...

CVE-2026-34872

In Mbed TLS versions 3.5.x and 3.6.x up to 3.6.5, and TF-PSA-Crypto 1.0, there is a fault in finite-field Diffie-Hellman (FFDH) due to improper input validation that results in a lack of contributory behavior. The peer can force the shared secret into a small set of values, which matters for prot...

CVE-2026-34871

CVE-2026-34871 affects Mbed TLS before 3.6.6 and 4.x before 4.1.0, due to a Predictable Seed in the PRNG. Evidence from multiple advisories notes remediation by upgrading to 3.6.6 (or newer) where getrandom is unavailable and /dev/urandom is used as fallback. Impact on confidentiality and integri...