Mbed Tls · Mbed Tls · CVE-2024-23775
**Name of the Vulnerable Software and Affected Versions**
Mbed TLS versions 2.x through 2.28.6
Mbed TLS versions 3.x through 3.5.1
**Description**
The issue is related to an integer overflow vulnerability in the `mbedtls x509 set extension()` function, which can be exploited by attackers to cause a denial of service (DoS). This vulnerability allows a remote attacker to trigger the DoS.
**Recommendations**
For Mbed TLS versions 2.x through 2.28.6, update to version 2.28.7 or later.
For Mbed TLS versions 3.x through 3.5.1, update to version 3.5.2 or later.
As a temporary workaround, consider restricting the use of the `mbedtls x509 set extension()` function until a patch is available.