Debian/mbedtls: medium 5.4

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostnam

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: DEBIAN-CVE-2025-27809
• https://security-tracker.debian.org/tracker/CVE-2025-27809

published 2025-03-25T06:15:41Z · modified 2026-09-01T20:05:45.375040636Z · JSON