CVE-2025-27810

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-27810

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27810.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-27810

Related

UBUNTU-CVE-2025-27810

Published

2025-03-25T06:15:41Z

Modified

2025-04-04T00:55:50.521767Z

Summary

[none]

Details

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

References

Affected packages

Alpine:v3.21 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.3-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

2.4.2-r0

2.5.1-r0

2.6.0-r0

2.6.1-r0

2.7.0-r0

2.11.0-r0

2.12.0-r0

2.14.1-r0

2.16.0-r0

2.16.1-r0

2.16.1-r1

2.16.2-r0

2.16.3-r0

2.16.5-r0

2.16.6-r0

2.16.8-r0

2.16.9-r0

2.16.10-r0

2.16.10-r1

2.16.12-r0

2.16.12-r1

2.28.0-r0

2.28.1-r0

2.28.1-r1

2.28.2-r0

2.28.3-r0

2.28.3-r1

2.28.3-r2

2.28.3-r3

2.28.4-r0

2.28.5-r0

2.28.6-r0

2.28.7-r0

2.28.8-r0

3.*

3.6.0-r0

3.6.1-r0

3.6.2-r0

Debian:11 / mbedtls

Package

Name: mbedtls
Purl: pkg:deb/debian/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.16.9-0.1

2.16.11-0.1

2.16.11-0.2

2.16.11-0.3

2.28.0-0.1

2.28.0-0.2

2.28.0-0.3

2.28.0-1

2.28.0-2

2.28.1-1

2.28.2-1

2.28.3-1

2.28.4-1

2.28.5-1

2.28.6-1

2.28.7-1

2.28.7-1.1~exp1

2.28.7-1.1

2.28.8-1

3.*

3.6.0-1

3.6.0-2

3.6.0-3

3.6.2-1

3.6.2-2

3.6.2-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / mbedtls

Package

Name: mbedtls
Purl: pkg:deb/debian/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.28.3-1

2.28.4-1

2.28.5-1

2.28.6-1

2.28.7-1

2.28.7-1.1~exp1

2.28.7-1.1

2.28.8-1

3.*

3.6.0-1

3.6.0-2

3.6.0-3

3.6.2-1

3.6.2-2

3.6.2-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / mbedtls

Package

Name: mbedtls
Purl: pkg:deb/debian/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.28.3-1

2.28.4-1

2.28.5-1

2.28.6-1

2.28.7-1

2.28.7-1.1~exp1

2.28.7-1.1

2.28.8-1

3.*

3.6.0-1

3.6.0-2

3.6.0-3

3.6.2-1

3.6.2-2

3.6.2-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/mbed-tls/mbedtls

Affected ranges

Type: GIT
Repo: https://github.com/mbed-tls/mbedtls
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2fc8413bfcb51354c8e679141b17b3f1a5942561

Affected versions

Other

beta-oob-2

list

mbedos-2016q1-oob1

mbedos-2016q1-oob2

mbedos-2016q1-oob3

mbedos-release-15-11

mbedos-techcon-oob2

mbedos-16.*

mbedos-16.01-release

mbedos-16.03-release

mbedtls-1.*

mbedtls-1.3.10

mbedtls-1.4-dtls-preview

mbedtls-2.*

mbedtls-2.0.0

mbedtls-2.1.0

mbedtls-2.1.1

mbedtls-2.1.2

mbedtls-2.10.0

mbedtls-2.11.0

mbedtls-2.12.0

mbedtls-2.13.0

mbedtls-2.13.1

mbedtls-2.14.0

mbedtls-2.15.0

mbedtls-2.15.1

mbedtls-2.16.0

mbedtls-2.17.0

mbedtls-2.18.0

mbedtls-2.19.0

mbedtls-2.19.0d1

mbedtls-2.19.0d2

mbedtls-2.19.1

mbedtls-2.2.0

mbedtls-2.2.1

mbedtls-2.20.0

mbedtls-2.20.0d0

mbedtls-2.20.0d1

mbedtls-2.21.0

mbedtls-2.22.0

mbedtls-2.22.0d0

mbedtls-2.23.0

mbedtls-2.24.0

mbedtls-2.25.0

mbedtls-2.26.0

mbedtls-2.27.0

mbedtls-2.28.0

mbedtls-2.28.1

mbedtls-2.28.2

mbedtls-2.28.3

mbedtls-2.28.4

mbedtls-2.28.5

mbedtls-2.28.6

mbedtls-2.28.7

mbedtls-2.28.8

mbedtls-2.28.9

mbedtls-2.3.0

mbedtls-2.4.0

mbedtls-2.5.0

mbedtls-2.5.1

mbedtls-2.6.0

mbedtls-2.6.0-rc1

mbedtls-2.7.0

mbedtls-2.7.0-rc1

mbedtls-2.8.0

mbedtls-2.8.0-rc1

mbedtls-2.9.0

polarssl-1.*

polarssl-1.2.0

polarssl-1.2.1

polarssl-1.2.2

polarssl-1.2.3

polarssl-1.2.4

polarssl-1.2.5

polarssl-1.2.6

polarssl-1.3.0

polarssl-1.3.0-rc0

polarssl-1.3.1

polarssl-1.3.2

polarssl-1.3.3

polarssl-1.3.4

polarssl-1.3.5

polarssl-1.3.6

polarssl-1.3.7

polarssl-1.3.8

polarssl-1.3.9

v2.*

v2.23.0

v2.24.0

v2.25.0

v2.26.0

v2.27.0

v2.28.0

v2.28.1

v2.28.2

v2.28.3

v2.28.4

v2.28.5

v2.28.6

v2.28.7

v2.28.8

v2.28.9

yotta-2.*

yotta-2.2.1

yotta-2.2.2

yotta-2.2.3

yotta-2.3.0

yotta-2.3.1