Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
Mbed TLS: Authentication Bypass Due to Uninitialized Memory
published 1 year ago
Summary
Mbed TLS versions 2.28.10 and earlier, and 3.x versions before 3.6.3, may allow attackers to bypass authentication in certain situations. This is because the software uses memory that hasn't been properly initialized, potentially allowing an attacker to trick the system into thinking they are who they're not. To fix this issue, update to version 2.28.10 or later, or version 3.6.3 or later of Mbed TLS.
What to do
- Update juliabinarywrappers mbedtls_jll to version 2.28.10+0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Julia | juliabinarywrappers | mbedtls_jll |
< 2.28.10+0 Fix: upgrade to 2.28.10+0
|
Original advisory text
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware...
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published23 Oct 2025
Updated23 Jul 2026
First seen23 Jul 2026
Sources
JLSEC-2025-187 · OSV
Track software like this
Free during beta