CVE-2021-43666 A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities Discovered in Mbed TLS Affecting Certificate Validation and Memory Security Two vulnerabilities were identified in Mbed TLS, affecting versions prior to 2.25.0 and 2.24.0. CVE-2020-36478 allows a NULL algorithm parameters entry to be misinterpreted as valid, while CVE-2020-36476 involves missing zeroization of plaintext buffers, risking exposure of sensitive data. Both issues were published on August 23, 2021. 9 sources 46

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (1)

Platforms (1)