JLSEC-2025-187
Medium · 5.4CVSS
5.4
EPSS
—
Published
Oct 23, 2025
CISA due date
—
The record
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware ...
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.18 | mbedtls | 0 | 2.28.10-r0 |
| Alpine:v3.19 | mbedtls | 0 | 2.28.10-r0 |
| Alpine:v3.20 | mbedtls | 0 | 3.6.3-r0 |
| Alpine:v3.21 | mbedtls | 0 | 3.6.3-r0 |
| Alpine:v3.22 | mbedtls | 0 | 3.6.3-r0 |
| Debian:11 | mbedtls | 0 | No fix |
| Debian:12 | mbedtls | 0 | No fix |
| Debian:13 | mbedtls | 0 | No fix |
| Debian:14 | mbedtls | 0 | 3.6.3-1 |
| Julia | MbedTLS_jll | 0 | 2.28.10+0 |
Related vulnerabilities
- CVE-2024-45157 An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the… Also affects mbedtls
- CVE-2024-28960 An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before… Also affects mbedtls
- CVE-2024-23775 Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows… Also affects mbedtls
- CVE-2024-23170 An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. Also affects mbedtls
- CVE-2023-43615 Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow. Also affects mbedtls
- CVE-2022-35409 An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. Also affects mbedtls
- CVE-2021-44732 Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as… Also affects mbedtls
- CVE-2024-49195 Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing… Also affects mbedtls