Skip to main content

Insecure Default Initialization of Resource

CVE-2025-27809

Medium
5.4/10

Summary

Mbed TLS through 2.28.9 and versions 3.X through 3.6.2, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls "mbedtls_ssl_set_hostname".

  • HIGH
  • NETWORK
  • LOW
  • CHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-1188 - Insecure Default Initialization of Resource

The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References

Advisory Timeline

  • Published