MB
Product
mbedtls
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 6Low 1
Watch
Add mbedtls to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-49601 | 6.5 | Jul 4 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible… Affected: 3.3.0 before 3.6.4 |
| CVE-2024-28755 | 6.5 | Apr 3 | An issue was discovered in Mbed TLS 3.5.x before 3.6.0 Affected: before 3.6.0 |
| CVE-2025-27809 | 5.4 | Mar 25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls… Affected: before 2.28.10; 3.0.0 before 3.6.3 |
| CVE-2025-49600 | 4.9 | Jul 4 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali… Affected: 3.3.0 before 3.6.4 |
| CVE-2025-52497 | 4.8 | Jul 4 | Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input Affected: before 3.6.4 |
| CVE-2025-27810 | 4.8 | Mar 25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message,… Affected: before 2.28.10; 3.0.0 before 3.6.3 |
Showing 6