Which CVEs affect mbedTLS 2.28.4?
No note: the vendor names the CVE in its own advisory for this version (14 of 32).
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2025-47917 | critical | 9.8 | 3.6.4 | vendor names no starting version for this release line |
| CVE-2026-34877 | critical | 9.8 | 3.6.6 | |
| CVE-2026-34872 | critical | 9.1 | 3.6.6 | per vulnerability databases |
| CVE-2024-28960 | high | 8.2 | 2.28.8 | |
| CVE-2025-52496 | high | 7.8 | 3.6.4 | vendor names no starting version for this release line |
| CVE-2026-25835 | high | 7.7 | 3.6.6 | |
| CVE-2021-43666 | high | 7.5 | not stated | per vulnerability databases |
| CVE-2021-45451 | high | 7.5 | 3.1.0 | per vulnerability databases |
| CVE-2023-43615 | high | 7.5 | 2.28.5 | |
| CVE-2023-52353 | high | 7.5 | 3.5.2 | per vulnerability databases |
| CVE-2024-23775 | high | 7.5 | 2.28.7 | |
| CVE-2025-48965 | high | 7.5 | 3.6.4 | vendor names no starting version for this release line |
| CVE-2026-34871 | medium | 6.7 | 3.6.6 | vendor names no starting version for this release line |
| CVE-2025-54764 | medium | 6.2 | 3.6.5 | vendor names no starting version for this release line |
| CVE-2024-23170 | medium | 5.5 | 2.28.7 | |
| CVE-2025-27809 | medium | 5.4 | 2.28.10 | |
| CVE-2025-59438 | medium | 5.3 | 3.6.5 | vendor names no starting version for this release line |
| CVE-2024-45157 | medium | 5.1 | 2.28.9 | |
| CVE-2025-66442 | medium | 5.1 | not stated | |
| CVE-2025-27810 | medium | 4.8 | 2.28.10 | |
| CVE-2025-52497 | medium | 4.8 | 3.6.4 | vendor names no starting version for this release line |
| CVE-2021-36647 | medium | 4.7 | 3.0.0 | per vulnerability databases |
| CVE-2026-35336 | not rated | not rated | not stated | vendor names no starting version for this release line |
| CVE-2026-49300 | not rated | not rated | not stated | vendor names no starting version for this release line |
| CVE-2026-50580 | not rated | not rated | not stated | |
| CVE-2026-50581 | not rated | not rated | not stated | vendor names no starting version for this release line |
| CVE-2026-50584 | not rated | not rated | not stated | |
| CVE-2026-50585 | not rated | not rated | not stated | vendor names no starting version for this release line |
| CVE-2026-50586 | not rated | not rated | not stated | |
| CVE-2026-50587 | not rated | not rated | not stated | |
| CVE-2026-54435 | not rated | not rated | not stated | vendor names no starting version for this release line |
| CVE-2026-54441 | not rated | not rated | not stated | vendor names no starting version for this release line |
Which mbedTLS version do I need to upgrade to?
Fixed in mbedTLS 2.28.5: 1 CVE of this version.
Fixed in mbedTLS 2.28.7: 2 CVEs of this version.
Fixed in mbedTLS 2.28.8: 1 CVE of this version.
Fixed in mbedTLS 2.28.9: 1 CVE of this version.
Fixed in mbedTLS 2.28.10: 2 CVEs of this version.
Fixed in mbedTLS 3.0.0: 1 CVE of this version.
Fixed in mbedTLS 3.1.0: 1 CVE of this version.
Fixed in mbedTLS 3.5.2: 1 CVE of this version.
Fixed in mbedTLS 3.6.4: 4 CVEs of this version.
Fixed in mbedTLS 3.6.5: 2 CVEs of this version.
Fixed in mbedTLS 3.6.6: 4 CVEs of this version.
No fix version stated: 12.
What changed against mbedTLS 2.28.3?
No CVE of 2.28.3 dropped out in 2.28.4.
No CVE was added in 2.28.4.
What does the number mean for a device?
Counted are the CVEs public sources name for mbedTLS version 2.28.4 (NVD, Vendor advisories). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Questions
How many CVEs does mbedTLS 2.28.4 have?
As of 13 Nov 2026, 32 CVEs are known for mbedTLS 2.28.4, 3 critical and 9 high. The vendor names 14 in its own advisory for exactly this version. For 13, the vendor names an end but no starting version on this release line; they are counted and marked too. 4.1.0, the newest listed version, still carries 11 of them.
From which version are the CVEs of mbedTLS 2.28.4 fixed?
No newer listed version is free of all 32 CVEs. The "Fixed from" column names the fix version per CVE for this release line where a source states one.
Sources
- [1]NVD