CVE-2025-27809

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Reserved 2025-03-07 | Published 2025-03-25 | Updated 2025-03-25 | Assigner mitre

Problem types

CWE-1188 Initialization of a Resource with an Insecure Default

Product status

Default status
unaffected

Any version before 2.28.10
affected

3.0.0 before 3.6.3
affected

References

github.com/Mbed-TLS/mbedtls/releases

mbed-tls.readthedocs.io/...dtls-security-advisory-2025-03-1/

cve.org (CVE-2025-27809)

nvd.nist.gov (CVE-2025-27809)

Download JSON