CVE-2025-27809

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published
Mar 25, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-27816.3The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default direcCVE-2025-278104.8Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory CVE-2025-278117.8A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escaCVE-2025-278128.1MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation.CVE-2025-278138.1MSI Center before 2.0.52.0 has Missing PE Signature Validation.CVE-2025-278169.8A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecurCVE-2025-278177.5A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration CVE-2025-278188.8A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or KafCVE-2025-278197.5In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not oCVE-2025-27826.3The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directorCVE-2025-278207.5A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. DisCVE-2025-278217.3Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Hadoop: from 3.2.0 before 3.4.2. Users ar