
We found results for “”
CVE-2025-27809
Good to know:

Date: March 24, 2025
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Initialization of a Resource with an Insecure Default
CWE-1188Top Fix

Upgrade Version
Upgrade to version https://github.com/Mbed-TLS/mbedtls.git - mbedtls-2.28.10;https://github.com/Mbed-TLS/mbedtls.git - mbedtls-3.6.3;https://github.com/Mbed-TLS/mbedtls.git - v2.28.10;https://github.com/Mbed-TLS/mbedtls.git - v3.6.3
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | HIGH |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | CHANGED |
Confidentiality (C): | LOW |
Integrity (I): | LOW |
Availability (A): | NONE |