Medium severity · published Mar 25, 2025
CVE-2025-27809
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls…
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
mbedtls · Mbed
before 2.28.10; 3.0.0 before 3.6.3 · source: vendor
MT
Mbed Tls · Arm
before 2.28.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27809
Release Notes
https://github.com/Mbed-TLS/mbedtls/releases
Third Party Advisory
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/
Issue Tracking
https://github.com/Mbed-TLS/mbedtls/issues/466
Not Applicable
https://mastodon.social/@bagder/114219540623402700
More from mbedtls
9.8
CVE-2025-47917
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation
9.8
CVE-2024-49195
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
9.8
CVE-2024-45158
An issue was discovered in Mbed TLS 3.6 before 3.6.1
9.8
CVE-2023-45199
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution
8.2
CVE-2024-28960
An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto