PT-2025-42888 · Arm+1 · Mbed Tls+1

CVE-2025-59438 · Published 2025-10-21 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions through 3.6.4

Description Mbed TLS contains an Observable Timing Discrepancy. This issue may allow for timing attacks.

Recommendations Update to a version of Mbed TLS newer than 3.6.4.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2025-59438

OPENSUSE-SU-2025:15662-1

OPENSUSE-SU-2025:15747-1

OPENSUSE-SU-2025:20035-1

OPENSUSE-SU-2026:10083-1

OPENSUSE-SU-2026:10378-1

OPENSUSE-SU-2026:20499-1

OPENSUSE-SU-2026:21144-1

SUSE-SU-2026:1413-1

SUSE-SU-2026:20769-1

SUSE-SU-2026:21018-1

SUSE-SU-2026:21161-1

Affected Products

Debian

Mbed Tls

References · 58

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59438.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:20035-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1413-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59438 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21144-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59438 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20769-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20499-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10378-1 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15662-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15747-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-59438 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59438 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10083-1 · Vendor Advisory