Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mbedtlsUpgrade mbedtls2Upgrade mbedtls3 | Mar 26, 2024 | Jan 31, 2024 |
| Debian | — | Upgrade mbedtls | May 15, 2025 | Jan 31, 2024 |
| Gentoo Linux | — | Upgrade net-libs/mbedtls. | Sep 23, 2024 | Jan 31, 2024 |
| Ubuntu | — | Upgrade libmbedcrypto7 (Ubuntu Pro)Upgrade libmbedtls14 (Ubuntu Pro)Upgrade libmbedcrypto7t64 (Ubuntu Pro)Upgrade libmbedx509-1 (Ubuntu Pro)Upgrade libmbedx509-0 (Ubuntu Pro)Upgrade libmbedcrypto1 (Ubuntu Pro)Upgrade libmbedtls10 (Ubuntu Pro)Upgrade libmbedtls14t64 (Ubuntu Pro)Upgrade libmbedx509-1t64 (Ubuntu Pro)Upgrade libmbedtls-dev (Ubuntu Pro)Upgrade libmbedtls12 (Ubuntu Pro)Upgrade libmbedcrypto3 (Ubuntu Pro) | Mar 27, 2026 | Mar 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub