CVE catalog

CVE-2025-59438

mbedtls: CVE-2025-59438

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.26% · Oct 25, 2026

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmbedtlssid3.6.7-3fixed
Debianmbedtlsforky3.6.7-3fixed
Debianmbedtlstrixie3.6.6-0.1~deb13u1fixed
Debianmbedtlsbookworm2.28.3-1vulnerable
Alpinembedtls3.203.6.5-r0fixed
Alpinembedtls3.213.6.5-r0fixed
Alpinembedtls3.223.6.5-r0fixed
Alpinembedtls3.233.6.5-r0fixed
Alpinembedtls3.243.6.5-r0fixed
Opensuseovmfleap 16.0202502-160000.4.1fixed
Suseovmflinux enterprise server 16.0202502-160000.4.1fixed
Suseovmflinux enterprise server for sap applications 16.0202502-160000.4.1fixed
Ubuntumbedtls16.042.1.2-1vulnerable
Ubuntumbedtls16.042.2.0-1vulnerable
Ubuntumbedtls16.042.2.1-1vulnerable
Ubuntumbedtls16.042.2.1-2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.1vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.2vulnerable
Ubuntumbedtls16.042.2.1-2ubuntu0.3vulnerable
Ubuntumbedtlspro2.16.2-1vulnerable
Ubuntumbedtlspro2.16.3-1vulnerable
Ubuntumbedtlspro2.16.4-1ubuntu2vulnerable
Ubuntumbedtlspro2.16.4-1ubuntu2+esm1vulnerable
Ubuntumbedtls22.042.16.9-0.1ubuntu1vulnerable
Ubuntumbedtls22.042.16.11-0.1ubuntu1vulnerable
Ubuntumbedtls22.042.16.11-0.3vulnerable
Ubuntumbedtls22.042.28.0-1vulnerable
Ubuntumbedtls22.042.28.0-1build1vulnerable
Ubuntumbedtls24.042.28.3-1vulnerable
Ubuntumbedtls24.042.28.6-1ubuntu1vulnerable
Ubuntumbedtls24.042.28.7-1ubuntu1vulnerable
Ubuntumbedtls24.042.28.7-1.1ubuntu1vulnerable
Ubuntumbedtls24.042.28.8-1vulnerable
Ubuntumbedtls25.103.6.2-3ubuntu1vulnerable
Suseovmflinux enterprise module for package hub 15 sp7202408-150700.3.15.1fixed
Suseovmflinux enterprise module for server applications 15 sp7202408-150700.3.15.1fixed
Suseovmflinux micro 6.2202502-160000.4.1fixed
Suseovmflinux micro 6.1202402-slfo.1.1_2.1fixed
Opensusevlangtumbleweed0.5-2.1fixed
Opensusemicropythonleap 16.01.26.0-bp160.1.1fixed
Opensusemicropythontumbleweed1.26.0-2.1fixed
Opensuseovmftumbleweed202602-5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmbedtlssourcesid3.6.5-0.1not yet assignedNot reported[1118752]
Debianmbedtlssourceforky3.6.5-0.1not yet assignedNot reported[1118752]
Debianmbedtlssourcetrixie3.6.5-0.1~deb13u1not yet assignedNot reported[1118752]
Debianmbedtlssourcebookworm(unfixed)end-of-lifeNot reported[1118752]
Alpinembedtlsapk3.203.6.5-r0Not reportedALPINE-CVE-2025-59438Not reported
Alpinembedtlsapk3.213.6.5-r0Not reportedALPINE-CVE-2025-59438Not reported
Alpinembedtlsapk3.223.6.5-r0Not reportedALPINE-CVE-2025-59438Not reported
Alpinembedtlsapk3.233.6.5-r0Not reportedALPINE-CVE-2025-59438Not reported
Alpinembedtlsapk3.243.6.5-r0Not reportedALPINE-CVE-2025-59438Not reported
Opensuseovmfrpmleap 16.0202502-160000.4.1Not reportedOPENSUSE-SU-2026:20499-1Not reported
Suseovmfrpmlinux enterprise server 16.0202502-160000.4.1Not reportedSUSE-SU-2026:21161-1Not reported
Suseovmfrpmlinux enterprise server for sap applications 16.0202502-160000.4.1Not reportedSUSE-SU-2026:21161-1Not reported
Suseovmfrpmlinux enterprise module for package hub 15 sp7202408-150700.3.15.1Not reportedSUSE-SU-2026:1413-1Not reported
Suseovmfrpmlinux enterprise module for server applications 15 sp7202408-150700.3.15.1Not reportedSUSE-SU-2026:1413-1Not reported
Suseovmfrpmlinux micro 6.2202502-160000.4.1Not reportedSUSE-SU-2026:21018-1Not reported
Suseovmfrpmlinux micro 6.1202402-slfo.1.1_2.1Not reportedSUSE-SU-2026:20769-1Not reported
Opensusevlangrpmtumbleweed0.5-2.1Not reportedOPENSUSE-SU-2026:10083-1Not reported
Opensusemicropythonrpmleap 16.01.26.0-bp160.1.1Not reportedOPENSUSE-SU-2025:20035-1Not reported
Opensusemicropythonrpmtumbleweed1.26.0-2.1Not reportedOPENSUSE-SU-2025:15662-1Not reported
Opensuseovmfrpmtumbleweed202602-5.1Not reportedOPENSUSE-SU-2026:10378-1Not reported

[Debian bug #1118752]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmbedcrypto7]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls14]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls-dev]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedtls-doc]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · all · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · all · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

  • [libmbedx509-1]Affected

    Source package: [mbedtls]

    Details (2)

    • 2.28.3-1 · amd64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

    • 2.28.3-1 · arm64 · bookworm

      Affected

      dsa · mbedtls · debian · bookworm; dsa · mbedtls · debian · 12

[openSUSE Tumbleweed]

  • [mpremote]Unknown

    Source package: [micropython]

    Details (1)

    • 1.28.0-2.3 · noarch · tumbleweed

      Unknown · Fixed: 1.26.0-2.1

      Version impact unknown

      dsa · micropython · opensuse · tumbleweed

  • [mpy-tools]Unknown

    Source package: [micropython]

    Details (1)

    • 1.28.0-2.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.26.0-2.1

      Version impact unknown

      dsa · micropython · opensuse · tumbleweed

  • [ovmf-tools]Unknown

    Source package: [ovmf]

    Details (1)

    • 202605-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 202602-5.1

      Version impact unknown

      dsa · ovmf · opensuse · tumbleweed

  • [qemu-ovmf-x86_64]Unknown

    Source package: [ovmf]

    Details (1)

    • 202605-3.1 · noarch · tumbleweed

      Unknown · Fixed: 202602-5.1

      Version impact unknown

      dsa · ovmf · opensuse · tumbleweed

  • [qemu-ovmf-x86_64-debug]Unknown

    Source package: [ovmf]

    Details (1)

    • 202605-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 202602-5.1

      Version impact unknown

      dsa · ovmf · opensuse · tumbleweed

  • [qemu-uefi-aarch64]Unknown

    Source package: [ovmf]

    Details (1)

    • 202605-3.1 · noarch · tumbleweed

      Unknown · Fixed: 202602-5.1

      Version impact unknown

      dsa · ovmf · opensuse · tumbleweed

  • [qemu-uefi-riscv64]Unknown

    Source package: [ovmf]

    Details (1)

    • 202605-3.1 · noarch · tumbleweed

      Unknown · Fixed: 202602-5.1

      Version impact unknown

      dsa · ovmf · opensuse · tumbleweed

  • [vlang-examples]Unknown

    Source package: [vlang]

    Details (1)

    • 0.5.2-2.1 · noarch · tumbleweed

      Unknown · Fixed: 0.5-2.1

      Version impact unknown

      dsa · vlang · opensuse · tumbleweed

  • [micropython]Fixed

    Source package: [micropython]

    Details (1)

    • 1.28.0-2.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.26.0-2.1

      dsa · micropython · opensuse · tumbleweed

  • [ovmf]Fixed

    Source package: [ovmf]

    Details (1)

    • 202605-3.1 · x86_64 · tumbleweed

      Fixed · Fixed: 202602-5.1

      dsa · ovmf · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libmbedcrypto16]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

  • [libmbedtls21]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

  • [libmbedtls-dev]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

  • [libmbedtls-doc]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · all · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · all · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

  • [libmbedx509-7]Fixed

    Source package: [mbedtls]

    Details (2)

    • 3.6.5-0.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

    • 3.6.5-0.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.6.5-0.1~deb13u1

      dsa · mbedtls · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]