mbedtls vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the mbedtls package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
L Off-by-one Error	<3.6.4-r0
M Out-of-bounds Read	<3.6.4-r0
L Incorrect Behavior Order	<3.6.4-r0
L Missing Required Cryptographic Step	<3.6.4-r0
L Use After Free	<3.6.4-r0
L Covert Timing Channel	<3.6.4-r0
L Compiler Optimization Removal or Modification of Security-critical Code	<3.6.4-r0
L CVE-2025-27809	<3.6.3-r0
L CVE-2025-27810	<3.6.3-r0
L CVE-2024-49195	<3.6.2-r0
C Improper Certificate Validation	<3.6.1-r0
L CVE-2024-45158	<3.6.1-r0
M CVE-2024-45157	<3.6.1-r0
M Information Exposure	<2.28.7-r0
C Out-of-bounds Write	<2.7.0-r0
H Improper Authentication	<2.6.0-r0
C Out-of-Bounds	<2.7.0-r0
H Improper Certificate Validation	<2.4.2-r0
C Integer Overflow or Wraparound	<2.7.0-r0
H Integer Overflow or Wraparound	<2.28.7-r0
L CVE-2024-28960	<2.28.8-r0
C Out-of-bounds Read	<2.28.1-r0
M Information Exposure	<2.16.8-r0
M Information Exposure	<2.16.4-r0
M Use of a Broken or Risky Cryptographic Algorithm	<2.16.6-r0
M Improper Privilege Management	<2.14.1-r0
C Double Free	<2.16.12-r0
M CVE-2018-0498	<2.12.0-r0
M CVE-2018-0497	<2.12.0-r0
M Information Exposure	<2.16.3-r0
H Buffer Overflow	<2.28.5-r0