
We found results for “”
CVE-2025-27810
Good to know:

Date: March 24, 2025
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Use of Uninitialized Resource
CWE-908Top Fix

Upgrade Version
Upgrade to version https://github.com/Mbed-TLS/mbedtls.git - mbedtls-2.28.10;https://github.com/Mbed-TLS/mbedtls.git - mbedtls-3.6.3;https://github.com/Mbed-TLS/mbedtls.git - v2.28.10;https://github.com/Mbed-TLS/mbedtls.git - v3.6.3
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | HIGH |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | CHANGED |
Confidentiality (C): | LOW |
Integrity (I): | LOW |
Availability (A): | NONE |