CVE-2025-27809 Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities Discovered in Mbed TLS Affecting Certificate Validation and Memory Security Two vulnerabilities were identified in Mbed TLS, affecting versions prior to 2.25.0 and 2.24.0. CVE-2020-36478 allows a NULL algorithm parameters entry to be misinterpreted as valid, while CVE-2020-36476 involves missing zeroization of plaintext buffers, risking exposure of sensitive data. Both issues were published on August 23, 2021. 9 sources 46

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)