PT-2025-12764 · Mbed Tls+3 · Mbed Tls+3

Published 2025-03-24 · Updated 2026-05-05 · CVE-2025-27809

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x through 2.28.9 Mbed TLS versions 3.x through 3.6.2

Description The issue allows servers with trusted certificates for arbitrary hostnames to be accepted by the client unless the TLS client application calls mbedtls ssl set hostname.

Recommendations For Mbed TLS versions 2.x through 2.28.9, update to version 2.28.10 or later. For Mbed TLS versions 3.x through 3.6.2, update to version 3.6.3 or later. As a temporary workaround, consider calling mbedtls ssl set hostname in the TLS client application to restrict the acceptance of servers with trusted certificates to specific hostnames.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

ALT-PU-2025-10462

ALT-PU-2025-4727

BDU:2025-06869

CVE-2025-27809

OPENSUSE-SU-2025:14928-1

Affected Products

Alt Linux

Debian

Mbed Tls

Red Os

References · 27

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27809 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27809 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27809 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-27809 · Security Note
• https://bdu.fstec.ru/vul/2025-06869 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-27809 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27809 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27809 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14928-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27809 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-27809 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://github.com/Mbed-TLS/mbedtls/releases · Note
• https://github.com/Mbed-TLS/mbedtls/issues/466 · Note