Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
Mbed TLS fails to verify server hostname
published 11 months ago
Summary
Mbed TLS versions 2.28.10 and earlier, and 3.x versions before 3.6.3, may connect to a server with a trusted certificate if the server's hostname doesn't match the certificate. This could allow a malicious server to impersonate a trusted one. To fix this, update to version 2.28.10 or 3.6.3 and ensure your application sets the server hostname when using Mbed TLS.
What to do
- Update juliabinarywrappers mbedtls_jll to version 2.28.10+0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Julia | juliabinarywrappers | mbedtls_jll |
< 2.28.10+0 Fix: upgrade to 2.28.10+0
|
Original advisory text
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted...
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls `mbedtls_ssl_set_hostname`.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published21 Nov 2025
Updated23 Jul 2026
First seen23 Jul 2026
Sources
JLSEC-2025-227 · OSV
Track software like this
Free during beta