Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-66442
5.1
MEDIUMCVSS v3
Published
April 1, 2026
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.
Mbed-TLS/mbedtls
GitHubAn open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
GitHubAn open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.<= 4.0.0NVD