PT-2025-45978 · Julia · Mbedtls Jll

Publicado 2025-10-23 · Atualizado 2025-10-23

OSV

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Correção

Identificadores relacionados

JLSEC-2025-187

Produtos afetados

Mbedtls Jll

Referências · 3

• https://github.com/Mbed-TLS/mbedtls/releases · Nota
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2 · Nota
• https://osv.dev/vulnerability/JLSEC-2025-187 · Aviso do Fabricante