Login Request a demo
MB
Product
mbedtls
by Mbed · last CVE Jul 20, 2025
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 2High 2Medium 3Low 1
Severity
All severities8Critical2High2Medium3Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add mbedtls to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-49601
6.5
0%
Jul 4
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible…
Affected: 3.3.0 before 3.6.4
CVE-2025-49600
4.9
0%
Jul 4
In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali…
Affected: 3.3.0 before 3.6.4
CVE-2025-52497
4.8
0%
Jul 4
Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input
Affected: before 3.6.4
Showing 3