Critical severity9.8NVD Advisory· Published Dec 15, 2022· Updated Jun 17, 2026
CVE-2022-46393
CVE-2022-46393
Description
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
- Mbed TLS/Mbed TLSdescription
- osv-coords4 versionspkg:rpm/opensuse/mbedtls-2&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/mbedtls-3&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/mbedtls&distro=openSUSE%20Leap%2015.4pkg:rpm/suse/mbedtls&distro=SUSE%20Package%20Hub%2015%20SP4
< 2.28.2-1.1+ 3 more
- (no CPE)range: < 2.28.2-1.1
- (no CPE)range: < 3.6.6-1.1
- (no CPE)range: < 2.28.0-bp154.2.3.1
- (no CPE)range: < 2.28.0-bp154.2.3.1
Patches
Vulnerability mechanics
References
5- github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2nvdRelease NotesThird Party Advisory
- github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0nvdRelease NotesThird Party Advisory
- mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/nvdVendor Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCOEEALUHZMFHXQHR6S4QL/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XMKJ5IMJEPXYAHHU56Z4P2FSYIEAESB/nvd
News mentions
0No linked articles in our index yet.