CVE-2022-46392

CVE-2022-46392 affects Mbed TLS 2.28.2 and 3.x prior to 3.3.0. An adversary with precise memory-access information (e.g., untrusted OS vs. secure enclave) can recover an RSA private key after a single private-key operation when MBEDTLS_MPI_WINDOW_SIZE is 3 or smaller. Debian/Siemens and related a...

CVE-2024-23170

Affected software: Mbed TLS 2.x (pre-2.28.7) and 3.x (pre-3.5.2). Root cause: Timing side-channel in RSA private operations. Impact: Local attacker could recover plaintext by sending a large number of messages for decryption, per the Everlasting ROBOT/Marvin Attack reference. Exploitation status:...

CVE-2020-10932

CVE-2020-10932 affects Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker able to obtain precise side‑channel measurements (often in compromised environments like SGX enclaves) can recover the long‑term ECDSA private key by exploiting side channels in scalar multiplication, convertin...

CVE-2024-28960

The PSA Crypto API in Mbed TLS (versions 2.18.0 through 2.28.x before 2.28.8, and 3.x before 3.6.0) and Mbed Crypto mishandles shared memory. This vulnerability leads to potential security risks as the API fails to correctly manage shared memory access. Impacted systems include Tencent Linux , De...

CVE-2021-36647

The issue (CVE-2021-36647) is in the mbed TLS library, specifically the function mbedtls_mpi_exp_mod() in lignum.c. All affected releases prior to 3.0.0, 2.27.0, or 2.16.11 are vulnerable. The underlying problem is the use of a broken or risky cryptographic algorithm that, when an attacker has pr...

CVE-2021-44732

CVE-2021-44732 affects MBed TLS before 3.0.1, with a double free in certain out-of-memory conditions triggered by mbedtls_ssl_set_session(). The issue is documented across several advisories (Debian, Mageia, Gentoo, Astra Linux) and is fixed in newer releases (e.g., MBed TLS 3.0.1+; Debian 2.16.9...

CVE-2024-28755

An issue was discovered in Mbed TLS 3.5.x (before version 3.6.0 ) involving the mbedtls_ssl_session_reset() API. When an SSL context is reset, the maximum TLS version to be negotiated is not restored to the configured value. This flaw allows an attacker to prevent an Mbed TLS server from establis...

CVE-2024-23775

This CVE refers to an Integer Overflow in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, enabling a denial of service via mbedtls_x509_set_extension(). The affected component is Mbed TLS (mbedtls_x509_set_extension). Root cause: integer overflow in the extension handling. Impact: DoS (availabil...

CVE-2019-16910

Arm Mbed TLS prior to 2.19.0 and Arm Mbed Crypto prior to 2.0.0 are affected by CVE-2019-16910. When deterministic ECDSA is enabled, the RNG blinding uses insufficient entropy, enabling a side-channel based attack that could recover a private key if the same message is signed repeatedly. The issu...

CVE-2022-35409

Mbed TLS DTLS heap over-read CVE-2022-35409: unauthenticated clients can send a malformed ClientHello to a DTLS server with MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN below a config-dependent threshold, causing a heap-based over-read of up to 255 bytes and possibly ...

CVE-2025-27809

MBed TLS vulnerability CVE-2025-27809 affects client-side TLS: versions before 2.28.10 and 3.x before 3.6.3 accept servers with trusted certificates for arbitrary hostnames unless the TLS client calls mbedtls_ssl_set_hostname. This can enable hostname validation bypass on affected clients. Connec...

CVE-2025-27810

CVE-2025-27810 affects Mbed TLS prior to 2.28.10 and 3.x prior to 3.6.3. In some failed memory allocation or hardware error scenarios, the library may use uninitialized stack memory to compose the TLS Finished message, potentially enabling authentication bypasses such as replays. Impact is descri...

CVE-2022-46393

CVE-2022-46393 affects MBEDTLS DTLS in MBEDTLS_SSL_DTLS_CONNECTION_ID when MBEDTLS_SSL_CID_IN_LEN_MAX > 2 × MBEDTLS_SSL_CID_OUT_LEN_MAX. This can cause a heap-based buffer overflow or over-read. Public detail: vulnerable in MBed TLS < 2.28.2 and

CVE-2017-14032

CVE-2017-14032 affects ARM mbed TLS: authentication bypass of peer-based authentication when optional authentication is configured via an X.509 chain with many intermediates. Affected products: mbed TLS from ARM (mbed TLS before 1.3.21 and 2.x before 2.1.9; and 2.x before 2.6.0). Impact stated: r...

CVE-2017-2784

CVE-2017-2784 affects ARM mbed TLS. A crafted X.509 certificate can trigger an invalid free of a stack pointer during parsing, potentially enabling remote code execution. Affected versions: mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. Impact includes remote code execution or ...

CVE-2021-45450

In Mbed TLS, versions before 2.28.0 and before 3.1.0 have a vulnerability in PSA cipher functions where psa_cipher_generate_iv and psa_cipher_encrypt can expose policy bypass or oracle-based decryption if the output buffer is accessible to an untrusted application. The issue affects older 2.x and...

CVE-2024-30166

The Mbed TLS library (versions 3.3.0 through 3.5.2 before 3.6.0 ) is vulnerable to a stack buffer over-read (less than 256 bytes). A malicious client can exploit this during a TLS 1.3 server connection via a TLS 3.1 ClientHello message, potentially leading to information disclosure or a denial of...

CVE-2023-43615

CVE-2023-43615 affects Mbed TLS: 2.x before 2.28.5 and 3.x before 3.5.0 suffer a Buffer Overflow. The advisories indicate upgrading to 2.28.5 (or 3.5.0) as the fix. Exploitation status is not provided in the supplied documents; no further details on in-the-wild exploitation are given.

CVE-2015-5291

CVE-2015-5291 and CVE-2015-8036 describe heap-based buffer overflows in PolarSSL (mbed TLS) that affect PolarSSL 1.x before 1.2.17 and mbed TLS 1.3.x before 1.3.14 and 2.x before 2.1.2. The flaw stems from improper boundary handling of the hostname/SNI extension in ClientHello, enabling remote at...

CVE-2018-19608

The CVE-2018-19608 issue affects Arm Mbed TLS prior to 2.14.1, prior to 2.7.8, and prior to 2.1.17. The root cause is a vulnerability in RSA decryption that enables a local unprivileged attacker to recover the plaintext used in RSA-without-(EC)DH(E) cipher suites, compromising confidentiality. Re...

CVE-2024-45158

Mbed TLS versions 3.6 through 3.6.0 are vulnerable to a stack buffer overflow in the mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() functions. This occurs when the bits parameter exceeds the largest supported curve; in configurations where PSA is disabled, all values of bits are impact...

CVE-2024-45159

CVE-2024-45159 affects Mbed TLS 3.x before 3.6.1. In TLS 1.3, when a server enables optional client authentication and the client certificate lacks proper values in keyUsage or extKeyUsage, mbedtls_ssl_get_verify_result() may incorrectly clear MBEDTLS_X509_BADCERT_KEY_USAGE bits. This can allow a...

CVE-2018-9988

CVE-2018-9988 affects ARM mbed TLS prior to 2.1.11, 2.7.2, and 2.8.0, with a buffer over-read in ssl_parse_server_key_exchange that could cause a crash on invalid input. Public-branch fixes exist in newer mbed TLS releases, and downstream advisories (e.g., Debian DLA-2826-1) note updates to mitig...

CVE-2024-45157

CVE-2024-45157 affects Mbed TLS releases prior to 2.28.9 and 3.x prior to 3.6.1, where the user-selected algorithm is not honored. Specifically, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not switch PSA to HMAC_DRBG; HMAC_DRBG is used only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRB...

CVE-2024-28836

An issue exists in Mbed TLS versions 3.5.x before 3.6.0 where the server-side TLS version negotiation can fall back to the TLS 1.2 implementation even if it is disabled. If TLS 1.2 is disabled at build time, a TLS 1.2 client can trigger an infinite loop while processing a ClientHello, leading to ...

CVE-2024-49195

The Mbed TLS cryptographic library versions 3.5.x through 3.6.x before 3.6.2 are affected by a buffer underrun vulnerability in the pkwrite function during the process of writing an opaque key pair. This vulnerability can lead to significant security risks, with a CRITICAL base severity score of ...

CVE-2015-8036

mbed TLS (formerly PolarSSL) contains heap-based buffer overflow vulnerabilities in multiple tracked CVEs. CVE-2015-5291 impacts the server name indication (SNI) hostname handling in ClientHello, enabling DoS or potential code execution; CVE-2015-8036 affects the session ticket extension in Clien...

CVE-2018-9989

CVE-2018-9989 affects ARM mbed TLS pre-2.1.11, pre-2.7.2, and pre-2.8.0, with a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input. The issue is documented across multiple advisories; Debian LTS/DLA-2826 notes fixes in mbedtls 2.4.2-1+deb9u4 for Debian 9, an...

CVE-2025-49087

The issue CVE-2025-49087 affects Mbed TLS 3.6.1–3.6.3 (pre-3.6.4) and is caused by a timing discrepancy in block cipher padding removal (PKCS#7), enabling plaintext recovery. IBM’s Power Systems bulletin confirms impact on PowerVM Hypervisor and provides remediation paths: install FW1110.10 (1110...

CVE-2026-25835

Mbed TLS versions prior to 3.6.6 and TF-PSA-Crypto versions prior to 1.1.0 are vulnerable to a security flaw involving the misuse of seeds in a Pseudo-Random Number Generator (PRNG) . This vulnerability can impact the cryptographic integrity of applications relying on these libraries for secure r...

CVE-2024-23744

The CVE-2024-23744 entry concerns Mbed TLS 3.5.1. The issue is a persistent handshake denial when a client sends a TLS 1.3 ClientHello without extensions, which can impact availability. The connected Astra Linux bulletin repeats this description, confirming the same root cause. No remediation or ...

CVE-2023-45199

CVE-2023-45199 is tied to Mbed TLS, affecting versions 3.2.x through 3.4.x up to the threshold of 3.5. The issue is a buffer overflow in Mbed TLS that can lead to remote code execution. The Initial document explicitly states the vulnerability, but the Connected documents do not provide concrete p...

CVE-2026-34877

The Mbed TLS SSL library is vulnerable in versions 2.19.0 through 3.6.5 and version 4.0.0 . The root cause is the Incorrect Use of Privileged APIs , specifically regarding the insufficient protection of serialized SSL context or session structures . An attacker capable of modifying these serializ...

CVE-2025-49600

In MBedTLS, CVE-2025-49600 affects 3.3.0 to before 3.6.4, where mbedtls_lms_verify can accept forged Leighton-Micali Signatures in fault scenarios. The root cause is unchecked return values from internal Merkle-tree calls (create_merkle_leaf_value and create_merkle_internal_value) which can leave...

CVE-2026-25833

The Mbed TLS library (versions 3.5.0 to 3.6.5) contains a buffer overflow (referenced as a buffer underflow in some advisories) within the x509_inet_pton_ipv6() function. This vulnerability could impact availability, as indicated by the CVSS 3.1 score of 7.5 with a HIGH availability impact. The i...

CVE-2026-34873

An issue exists in Mbed TLS versions 3.5.0 through 4.0.0 where client impersonation can occur during the resumption of a TLS 1.3 session . This vulnerability affects various Linux distributions and embedded systems using the library. For instance, Fedora 42, 43, and 44 have addressed related issu...

CVE-2025-49601

CVE-2025-49601 affects MbedTLS 3.3.0 through 3.6.3 (fixed in 3.6.4). The issue is in mbedtls_lms_import_public_key, which reads a 4-byte type indicator before validating the input size. If the input LMS public-key buffer is truncated to fewer than four bytes, this allows an out-of-bounds read, po...

CVE-2026-34876

An out-of-bounds read vulnerability exists in Mbed TLS versions 3.x before 3.6.6 within the mbedtls_ccm_finish() function in library/ccm.c. The root cause is a lack of validation for the tag_len parameter against the internal 16-byte authentication buffer. Attackers can exploit this by invoking t...

CVE-2026-34875

A buffer overflow vulnerability exists in Mbed TLS (versions through 3.6.5) and TF-PSA-Crypto (version 1.0.0). The flaw occurs during the public key export process for FFDH keys . This vulnerability has been addressed in the libeverest-3.6.6-1.1 package on openSUSE Tumbleweed . While technical de...

CVE-2026-34874

A NULL pointer dereference vulnerability exists in the Mbed TLS cryptographic library, specifically within the distinguished name parsing function. This flaw affects versions through 3.6.5 and 4.x through 4.0.0 , potentially allowing an attacker to write to address 0 . Impacted systems include Fe...

CVE-2026-25834

The Mbed TLS library, specifically versions v3.3.0 up to 3.6.5 and 4.0.0 , is susceptible to an Algorithm Downgrade vulnerability (CVE-2026-25834). This issue allows an attacker to force the use of weaker cryptographic algorithms. Security updates have been released for various distributions to m...