Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mbedtlsUpgrade mbedtls2Upgrade mbedtls3 | Mar 26, 2024 | Dec 20, 2021 |
| Debian | — | Upgrade mbedtls | Dec 28, 2022 | Dec 20, 2021 |
| Freebsd | — | Upgrade mbedtls | Nov 4, 2022 | Dec 30, 2021 |
| Gentoo Linux | — | Upgrade net-libs/mbedtls. | Jan 12, 2023 | Dec 20, 2021 |
| Ubuntu | — | Upgrade libmbedx509-0 (Ubuntu Pro)Upgrade libmbedcrypto7t64 (Ubuntu Pro)Upgrade libmbedcrypto1 (Ubuntu Pro)Upgrade libmbedtls14t64 (Ubuntu Pro)Upgrade libmbedx509-1 (Ubuntu Pro)Upgrade libmbedcrypto7 (Ubuntu Pro)Upgrade libmbedtls-dev (Ubuntu Pro)Upgrade libmbedcrypto3 (Ubuntu Pro)Upgrade libmbedtls14 (Ubuntu Pro)Upgrade libmbedtls10 (Ubuntu Pro)Upgrade libmbedtls12 (Ubuntu Pro)Upgrade libmbedx509-1t64 (Ubuntu Pro) | Mar 27, 2026 | Mar 25, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub