PT-2025-45978 · Julia · Mbedtls Jll

Published 2025-10-23 · Updated 2025-10-23

OSV

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Fix

Related Identifiers

JLSEC-2025-187

Affected Products

Mbedtls Jll

References · 3

• https://osv.dev/vulnerability/JLSEC-2025-187 · Vendor Advisory
• https://github.com/Mbed-TLS/mbedtls/releases · Note
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2 · Note