CVE-2025-49087 — Covert Timing Channel in Mbedtls
Severity
3.7LOWNVD
CNA4.0
EPSS
0.1%
top 66.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 20
Latest updateJul 21
Description
In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4
Affected Packages3 packages
🔴Vulnerability Details
3📋Vendor Advisories
1Debian▶
CVE-2025-49087: mbedtls - In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block ciph...↗2025