CVE-2025-27809CWE-1188

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client…

Medium · published March 25, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.5th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2025-03-25T00:00Z
EPSS history
Timeline
  • 25 MAR 00:00Z
    Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client…
    cvelistv5