CVE-2020-36475 An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities Discovered in Mbed TLS Affecting Certificate Validation and Memory Security Two vulnerabilities were identified in Mbed TLS, affecting versions prior to 2.25.0 and 2.24.0. CVE-2020-36478 allows a NULL algorithm parameters entry to be misinterpreted as valid, while CVE-2020-36476 involves missing zeroization of plaintext buffers, risking exposure of sensitive data. Both issues were published on August 23, 2021. 9 sources 46

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (1)

Platforms (1)