AIKIDO-2026-605024
Mbed-TLS.mbedtls is vulnerable to NULL Pointer Dereference
40
Medium Risk
This Affects:
Mbed-TLS.mbedtlsTL;DR
The function mbedtls_asn1_store_named_data() can leave a list entry in an inconsistent state where the value pointer is NULL but its length is non-zero. This is reachable directly or through X.509 name-writing helpers such as mbedtls_x509_string_to_names() when an input string contains two entries of the same type, one non-empty followed by one of zero length. Later use of the list dereferences the NULL pointer and crashes the process. The fix keeps the length consistent so the stale NULL pointer is not dereferenced.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application builds X.509 names from untrusted input strings.
Background info
Mbed-TLS.mbedtls is vulnerable to NULL Pointer Dereference in versions 1.0.0 - 3.6.3.
How to fix this
Upgrade the Mbed-TLS.mbedtls library to the patch version.
Links
GitHub Release
Other
github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md
mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/lists.debian.org/debian-lts-announce/2025/08/msg00013.html
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant