AIKIDO-2026-645528
Mbed-TLS.mbedtls is vulnerable to Execution with Unnecessary Privileges
39
Low Risk
This Affects:
Mbed-TLS.mbedtlsTL;DR
Mbed TLS contains an unsafe deserialization vulnerability affecting TLS session and context restoration. Applications that restore serialized TLS state from untrusted or modified data may trigger memory safety issues, including out-of-bounds reads or writes, potentially leading to crashes or application compromise. Additionally, disclosure of serialized TLS state can compromise the confidentiality and integrity of the associated TLS session. The vulnerability affects applications that fail to adequately protect serialized TLS data.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and restore TLS sessions or contexts from serialized data that is not integrity-protected (for example via mbedtls_ssl_session_load / mbedtls_ssl_context_load).
Background info
Mbed-TLS.mbedtls is vulnerable to Execution with Unnecessary Privileges in versions 2.19.0 - 3.6.5 and 4.0.0 - 4.0.0.
How to fix this
To mitigate the vulnerability, upgrade to a patched version or store serialized TLS state only in trusted storage, protect it with authenticated encryption or a secure MAC, prevent untrusted access or modification, and verify its integrity before restoring TLS sessions or contexts.
Links
GitHub Release
Other
mbed-tls.readthedocs.io/en/latest/security-advisories/mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant