CVE catalog

CVE-2025-27809

mbedtls: CVE-2025-27809

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.20% · Oct 25, 2026

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmbedtlssid3.6.7-3fixed
Debianmbedtlsforky3.6.7-3fixed
Debianmbedtlstrixie3.6.6-0.1~deb13u1fixed
Debianmbedtlsbookworm2.28.3-1vulnerable
Alpinembedtls3.182.28.10-r0fixed
Alpinembedtls3.192.28.10-r0fixed
Alpinembedtls3.203.6.3-r0fixed
Alpinembedtls3.213.6.3-r0fixed
Alpinembedtls3.223.6.3-r0fixed
Alpinembedtls3.233.6.3-r0fixed
Alpinembedtls3.243.6.3-r0fixed
Ubuntumbedtls16.042.1.2-1vulnerable
Ubuntumbedtls16.042.2.0-1vulnerable
Ubuntumbedtls16.042.2.1-1vulnerable
Ubuntumbedtls16.042.2.1-2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.1vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.3vulnerable
Ubuntumbedtlspro2.16.2-1vulnerable
Ubuntumbedtlspro2.16.3-1vulnerable
Ubuntumbedtlspro2.16.4-1ubuntu2vulnerable
Ubuntumbedtlspro2.16.4-1ubuntu2+esm1vulnerable
Ubuntumbedtls22.042.16.9-0.1ubuntu1vulnerable
Ubuntumbedtls22.042.16.11-0.1ubuntu1vulnerable
Ubuntumbedtls22.042.16.11-0.3vulnerable
Ubuntumbedtls22.042.28.0-1vulnerable
Ubuntumbedtls22.042.28.0-1build1vulnerable
Ubuntumbedtls24.042.28.3-1vulnerable
Ubuntumbedtls24.042.28.6-1ubuntu1vulnerable
Ubuntumbedtls24.042.28.7-1ubuntu1vulnerable
Ubuntumbedtls24.042.28.7-1.1ubuntu1vulnerable
Ubuntumbedtls24.042.28.8-1vulnerable
Ubuntumbedtls25.103.6.2-3ubuntu1vulnerable
Opensusembedtls-2tumbleweed2.28.10-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmbedtlssourcesid3.6.3-1not yet assignedNot reported[1101499]
Debianmbedtlssourceforky3.6.3-1not yet assignedNot reported[1101499]
Debianmbedtlssourcetrixie3.6.3-1not yet assignedNot reported[1101499]
Debianmbedtlssourcebookworm(unfixed)not yet assignedNot reported[1101499]
Alpinembedtlsapk3.182.28.10-r0Not reportedALPINE-CVE-2025-27809Not reported
Alpinembedtlsapk3.192.28.10-r0Not reportedALPINE-CVE-2025-27809Not reported
Alpinembedtlsapk3.203.6.3-r0Not reportedALPINE-CVE-2025-27809Not reported
Alpinembedtlsapk3.213.6.3-r0Not reportedALPINE-CVE-2025-27809Not reported
Alpinembedtlsapk3.223.6.3-r0Not reportedALPINE-CVE-2025-27809Not reported
Alpinembedtlsapk3.233.6.3-r0Not reportedALPINE-CVE-2025-27809Not reported
Alpinembedtlsapk3.243.6.3-r0Not reportedALPINE-CVE-2025-27809Not reported
Opensusembedtls-2rpmtumbleweed2.28.10-1.1Not reportedOPENSUSE-SU-2025:14928-1Not reported

[Debian bug #1101499]

Notes

[bookworm] mbedtls: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmbedcrypto7]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls14]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls-dev]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls-doc]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · all · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · all · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedx509-1]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

[openSUSE Tumbleweed]

  • [libmbedcrypto7]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedcrypto7-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls14]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls14-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedx509-1]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [libmbedx509-1-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

  • [mbedtls-2-devel]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.10-1.1

      Version impact unknown

      dsa · mbedtls-2 · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libmbedcrypto16]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

  • [libmbedtls21]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

  • [libmbedtls-dev]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

  • [libmbedtls-doc]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · all · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · all · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

  • [libmbedx509-7]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.3-1

      dsa · mbedtls · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]