Vulnerability Description
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
CVSS Score
5.4
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arm | Mbed Tls | < 2.28.10 |
Related Weaknesses (CWE)
References
- https://github.com/Mbed-TLS/mbedtls/releasesRelease Notes
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-aThird Party Advisory
- https://github.com/Mbed-TLS/mbedtls/issues/466Issue Tracking
- https://mastodon.social/@bagder/114219540623402700Not Applicable
FAQ
What is CVE-2025-27809?
CVE-2025-27809 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostnam...
How severe is CVE-2025-27809?
CVE-2025-27809 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-27809?
Check the references section above for vendor advisories and patch information. Affected products include: Arm Mbed Tls.