Medium severity5.4NVD Advisory· Published Mar 25, 2025· Updated Jun 17, 2026

CVE-2025-27809

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Arm/MbedTLS3 versions
cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*range: <2.28.10
- cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*range: >=3.0.0,<3.6.3
- (no CPE)range: <2.28.10, <3.6.3
osv-coords
pkg:rpm/opensuse/mbedtls-2&distro=openSUSE%20Tumbleweed
Range: < 2.28.10-1.1
Mbed/mbedtlsv5
Range: 0

Patches

Vulnerability mechanics

References

mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/nvdThird Party Advisory
github.com/Mbed-TLS/mbedtls/issues/466nvdIssue Tracking
github.com/Mbed-TLS/mbedtls/releasesnvdRelease Notes
mastodon.social/@bagder/114219540623402700nvdNot Applicable

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000