← Database

CVE-2025-27809

MEDIUM CVSS: 5.4 Published: 2025-03-25 Modified: 2026-06-17

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Affected Platforms

Arm Mbed TlsTrustedfirmware Mbed Tls

Weakness Type

CWE-1188

References