PT-2024-23220 · Mbed Tls · Mbed Tls

Published 2024-04-02 · Updated 2025-06-27 · CVE-2024-30166

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.3.0 through 3.5.2

Description A malicious client can cause information disclosure or a denial of service due to a stack buffer over-read in a TLS 1.3 server via a TLS 3.1 ClientHello. This occurs because of a buffer over-read of less than 256 bytes.

Recommendations For Mbed TLS versions 3.3.0 through 3.5.2, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to TLS 1.3 servers to minimize the risk of exploitation. Avoid using the TLS 3.1 ClientHello in the affected API endpoint until the issue is resolved.

Fix

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-30166

Affected Products

Mbed Tls

References · 12

• https://osv.dev/vulnerability/CVE-2024-30166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30166 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-30166 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-30166 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-30166 · Security Note
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0 · Note
• https://twitter.com/CVEnew/status/1775352032683045003 · Twitter Post
• https://t.me/cvenotify/75597 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1775398412004782488 · Twitter Post
• https://t.me/cvenotify/126931 · Telegram Post
• https://t.me/cvenotify/88246 · Telegram Post