Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mbedtlsUpgrade mbedtls2Upgrade mbedtls3 | Aug 8, 2025 | Mar 25, 2025 |
| Debian | — | Upgrade mbedtls | May 15, 2025 | Mar 25, 2025 |
| Ubuntu | — | Upgrade libmbedcrypto3 (Ubuntu Pro)Upgrade libmbedx509-1t64 (Ubuntu Pro)Upgrade libmbedcrypto7t64 (Ubuntu Pro)Upgrade libmbedtls-dev (Ubuntu Pro)Upgrade libmbedtls12 (Ubuntu Pro)Upgrade libmbedcrypto7 (Ubuntu Pro)Upgrade libmbedtls10 (Ubuntu Pro)Upgrade libmbedx509-0 (Ubuntu Pro)Upgrade libmbedx509-1 (Ubuntu Pro)Upgrade libmbedtls14t64 (Ubuntu Pro)Upgrade libmbedcrypto1 (Ubuntu Pro)Upgrade libmbedtls14 (Ubuntu Pro) | Mar 27, 2026 | Mar 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub