PT-2025-48508 · Julia · Mbedtls Jll

Published 2025-11-21 · Updated 2025-11-21

OSV

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls mpi exp mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.

Related Identifiers

JLSEC-2025-210

Affected Products

Mbedtls Jll

References · 7

• https://osv.dev/vulnerability/JLSEC-2025-210 · Vendor Advisory
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0 · Note
• https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html · Note
• https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf · Note