PT-2021-6077 · Mbed Tls+5 · Mbed Tls+5

Published 2021-12-18 · Updated 2026-06-05 · CVE-2021-44732

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 3.0.1

Description The issue is related to a double free error in certain out-of-memory conditions, as demonstrated by a failure of the mbedtls ssl set session() function. This error can potentially allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 3.0.1, update to version 3.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mbedtls ssl set session() function until a patch is available.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2021-3553

ALT-PU-2022-2561

ALT-PU-2025-10462

BDU:2022-00710

CVE-2021-44732

DLA-3249-1

DLA-4236-1

MGASA-2022-0017

USN-8123-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Mbed Tls

Ubuntu

References · 37

• 🔥 https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44732 · Security Note
• https://bdu.fstec.ru/vul/2022-00710 · Security Note
• https://ubuntu.com/security/CVE-2025-52497 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8123-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3249-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44732 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44732 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/673339 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27810 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8123-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0017.html · Security Note
• https://osv.dev/vulnerability/CVE-2021-44732 · Vendor Advisory