CVE-2025-49087

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-385

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-490885.9Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input CVE-2025-490896.3wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.CVE-2025-49097.3A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown CVE-2025-490907.1The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.CVE-2025-490918.2KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a s CVE-2025-49109.8A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown p CVE-2025-49119.8A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the CVE-2025-491123.1setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used.CVE-2025-491138.8Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a CVE-2025-49129.1A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerabi CVE-2025-491248.4Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacl CVE-2025-491257.5Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted o