PT-2025-42888 · Arm+1 · Mbed Tls+1

Published 2025-10-21 · Updated 2026-05-05 · CVE-2025-59438

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions through 3.6.4

Description Mbed TLS contains an Observable Timing Discrepancy. This issue may allow for timing attacks.

Recommendations Update to a version of Mbed TLS newer than 3.6.4.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2025-59438

OPENSUSE-SU-2025:15662-1

OPENSUSE-SU-2025:15747-1

OPENSUSE-SU-2025:20035-1

OPENSUSE-SU-2026:10083-1

OPENSUSE-SU-2026:10378-1

OPENSUSE-SU-2026:20499-1

SUSE-SU-2026:1413-1

SUSE-SU-2026:20769-1

SUSE-SU-2026:21018-1

SUSE-SU-2026:21161-1

Affected Products

Debian

Mbed Tls

References · 31

• https://osv.dev/vulnerability/CVE-2025-59438 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21161-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59438 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59438 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59438 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1413-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59438 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20035-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21018-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59438 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20499-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10378-1 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-invalid-padding-error · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15662-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-59438 · Vendor Advisory