CVE-2025-27809

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x through 2.28.9 Mbed TLS versions 3.x through 3.6.2

Description The issue allows servers with trusted certificates for arbitrary hostnames to be accepted by the client unless the TLS client application calls mbedtls ssl set hostname.

Recommendations For Mbed TLS versions 2.x through 2.28.9, update to version 2.28.10 or later. For Mbed TLS versions 3.x through 3.6.2, update to version 3.6.3 or later. As a temporary workaround, consider calling mbedtls ssl set hostname in the TLS client application to restrict the acceptance of servers with trusted certificates to specific hostnames.