Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2025-27810: Mbed TLS: Uninitialized Data in TLS Messages Can Bypass Authentication
CVE-2025-27810 · published 1 year ago
Summary
An issue in some versions of Mbed TLS can cause authentication to be bypassed. This is because the software uses memory that hasn't been properly cleaned up, potentially allowing hackers to intercept and reuse secure messages. To stay secure, update to the latest version of Mbed TLS, version 2.28.10 or 3.6.3 and later.
What to do
- Update alpine mbedtls to version 3.6.3-r0.
- Update alpine mbedtls to version 2.28.10-r0.
- Update debian rootio-mbedtls to version 2.28.3-1.root.io.13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | arm | mbed_tls |
< 2.28.10 >= 3.0.0, < 3.6.3 cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:* |
| Alpine:v3.21 | alpine | mbedtls |
< 3.6.3-r0 Fix: upgrade to 3.6.3-r0
|
| Alpine:v3.22 | alpine | mbedtls |
< 3.6.3-r0 Fix: upgrade to 3.6.3-r0
|
| Alpine:v3.23 | alpine | mbedtls |
< 3.6.3-r0 Fix: upgrade to 3.6.3-r0
|
| Alpine:v3.24 | alpine | mbedtls |
< 3.6.3-r0 Fix: upgrade to 3.6.3-r0
|
| Alpine:v3.18 | alpine | mbedtls |
< 2.28.10-r0 Fix: upgrade to 2.28.10-r0
|
| Alpine:v3.19 | alpine | mbedtls |
< 2.28.10-r0 Fix: upgrade to 2.28.10-r0
|
| Alpine:v3.20 | alpine | mbedtls |
< 3.6.3-r0 Fix: upgrade to 3.6.3-r0
|
| Root:Debian:12 | debian | rootio-mbedtls |
< 2.28.3-1.root.io.13 Fix: upgrade to 2.28.3-1.root.io.13
|
Original advisory text
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading ...
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
References
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-a... Vendor Advisory
- https://github.com/Mbed-TLS/mbedtls/releases Product
- https://security.alpinelinux.org/vuln/CVE-2025-27810 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27810... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-27810 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.4
Medium
Type
CWE-908Use of Uninitialized Resource
Timeline
Published25 Mar 2025
Updated3 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta