Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-27810
5.4
MEDIUMCVSS v3
Published
March 25, 2025
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
Mbed-TLS/mbedtls
GitHubAn open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
GitHubAn open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.< 2.28.10, = *, >= 3.0.0, < 3.6.3NVD