Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/mbedtls@2.16.9-0.1%2Bdeb11u2?distro=trixie
purl pkg:deb/debian/mbedtls@2.16.9-0.1%2Bdeb11u2?distro=trixie
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (3)
Vulnerability Summary Aliases
VCID-7ppw-f9jy-k7ae Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input. CVE-2025-52497
VCID-7v3a-5q44-cucz Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero. CVE-2025-48965
VCID-zpq1-dwvf-8ka2 Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery. CVE-2025-52496

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-03T07:45:37.466683+00:00 Debian Importer Fixing VCID-7ppw-f9jy-k7ae https://security-tracker.debian.org/tracker/data/json 38.1.0
2026-04-03T07:45:37.400225+00:00 Debian Importer Fixing VCID-zpq1-dwvf-8ka2 https://security-tracker.debian.org/tracker/data/json 38.1.0
2026-04-03T07:45:37.163031+00:00 Debian Importer Fixing VCID-7v3a-5q44-cucz https://security-tracker.debian.org/tracker/data/json 38.1.0