High DLA-4274-1 4 CVEs

mbedtls - security update

Published Aug 18, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	mbedtls	2.16.9-0.1+deb11u2

Vulnerabilities 4

High 8.9

CVE-2025-47917 Public exploit

Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance wi…

Mbed mbedtls mbedtls mbedtls Debian Ubuntu Alpine

Jul 20, 2025
High 7.8

CVE-2025-52496

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may …

Mbed mbedtls mbedtls mbedtls Debian Ubuntu Alpine

Jul 4, 2025
Medium 4.8

CVE-2025-52497

Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtl…

Mbed mbedtls mbedtls mbedtls Debian Ubuntu Alpine

Jul 4, 2025
Medium 4.0

CVE-2025-48965

Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data…

Mbed mbedtls mbedtls mbedtls Debian Ubuntu Alpine

Jul 20, 2025