Priority MEDIUM 51
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01258 · Published 2023-10-07 · No fix listed CWE-120
Priority MEDIUM 51
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01255 · Published 2022-12-15 · No fix listed CWE-125
Priority MEDIUM 50
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00629 · Published 2024-10-15 · No fix listed CWE-787
Priority MEDIUM 50
An issue was discovered in Mbed TLS 3.6 before 3.6.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00683 · Published 2024-09-05 · No fix listed CWE-121
Priority MEDIUM 49
An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00442 · Published 2026-04-02 · No fix listed CWE-250
Priority MEDIUM 49
An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00373 · Published 2026-04-01 · No fix listed CWE-120
Priority MEDIUM 49
An issue was discovered in Mbed TLS 3.x before 3.6.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00387 · Published 2024-09-05 · No fix listed CWE-295
Priority MEDIUM 47
An issue was discovered in Mbed TLS 3.5.0 through 4.0.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00251 · Published 2026-04-01 · No fix listed CWE-287
Priority MEDIUM 47
In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 Clie…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0073 · Published 2024-04-03 · No fix listed CWE-121
Priority MEDIUM 47
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0277 · Published 2021-12-20 · No fix listed CWE-415
Priority MEDIUM 44
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.023 · Published 2022-07-15 · No fix listed CWE-125
Priority MEDIUM 43
An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.0084 · Published 2024-03-29 · No fix listed CWE-284
Priority MEDIUM 41
Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01111 · Published 2024-01-31 · No fix listed CWE-190
Priority MEDIUM 41
Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00941 · Published 2023-10-07 · No fix listed CWE-120
Priority MEDIUM 41
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.0339 · Published 2017-04-20 · No fix listed CWE-295
Priority MEDIUM 40
An issue was discovered in Mbed TLS 3.5.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00685 · Published 2024-01-21 · No fix listed CWE-400
Priority LOW 39
An issue was discovered in Mbed TLS 3.x before 3.6.6.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00406 · Published 2026-04-02 · No fix listed CWE-125
Priority LOW 38
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.01492 · Published 2017-08-30 · No fix listed CWE-287
Priority LOW 37
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02158 · Published 2018-04-10 · No fix listed CWE-125
Priority LOW 37
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02158 · Published 2018-04-10 · No fix listed CWE-125
Priority LOW 36
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly ex…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.03646 · Published 2015-11-02 · No fix listed CWE-119
Priority LOW 35
An issue was discovered in Mbed TLS 3.5.x before 3.6.0.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00403 · Published 2024-04-03 · No fix listed CWE-326
Priority LOW 35
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted applic…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01226 · Published 2021-12-21 · No fix listed CWE-327
Priority LOW 35
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02867 · Published 2015-11-02 · No fix listed CWE-119
Priority LOW 34
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00141 · Published 2026-04-01 · No fix listed CWE-295
Load more
THREATIST.IORead the docs