Search for vulnerabilities
Vulnerability details: VCID-p6yu-3gyw-f3e1
Vulnerability ID VCID-p6yu-3gyw-f3e1
Aliases CVE-2022-35409
Summary An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-125 Out-of-bounds Read
System Score Found at
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00519 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2022-35409
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2022-35409
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-35409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35409
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
https://mbed-tls.readthedocs.io/en/latest/security-advisories/advisories/mbedtls-security-advisory-2022-07.html
cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2022-35409 https://nvd.nist.gov/vuln/detail/CVE-2022-35409
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-35409
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.65822
EPSS Score 0.00519
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:32:39.542964+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.22/main.json 37.0.0