Mbed TLS CVE-2025-48965

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:14 vuln.today

DescriptionCVE.org

Alpine Linux: mbedtls fixed in 3.6.4-r0

AnalysisAI

Mbed TLS (mbedtls) on Alpine Linux received a security fix in package version 3.6.4-r0, addressing CVE-2025-48965. The nature of the underlying vulnerability - its attack vector, impact class, and root cause - is not disclosed in the available intelligence. No active exploitation has been identified, and the EPSS probability of 0.20% (41st percentile) indicates low observed exploitation interest at time of analysis. Security teams running Alpine Linux with the mbedtls package should treat this as a routine patch cycle item pending further vendor disclosure.

Technical ContextAI

Mbed TLS (formerly PolarSSL) is an open-source SSL/TLS and cryptographic library maintained by TrustedFirmware and widely used in embedded systems, IoT devices, and Linux distributions including Alpine Linux. It implements TLS 1.2/1.3, X.509 certificate handling, and a broad set of cryptographic primitives (AES, RSA, ECC, SHA, etc.). Alpine Linux packages mbedtls as a shared library used by dependent software in the Alpine ecosystem. The fix version 3.6.4-r0 corresponds to Alpine's packaging of upstream Mbed TLS 3.6.4. No CWE root cause class is available in the provided data, so the specific vulnerability category (e.g., buffer overflow, use-after-free, cryptographic weakness, improper validation) cannot be determined from current intelligence.

Affected ProductsAI

Alpine Linux packages of mbedtls prior to version 3.6.4-r0 are affected. The fix was introduced in Alpine package mbedtls-3.6.4-r0, corresponding to upstream Mbed TLS version 3.6.4. Specific Alpine Linux release branches carrying the vulnerable package are not enumerated in the available data. No CPE strings were provided. Downstream software on Alpine that links against the mbedtls shared library may inherit exposure depending on the nature of the vulnerability. Consult the Alpine Linux security tracker and the Mbed TLS upstream advisory for authoritative version scope.

RemediationAI

Upgrade the Alpine Linux mbedtls package to version 3.6.4-r0 or later using the Alpine package manager: 'apk upgrade mbedtls'. This is the vendor-released patch per the Alpine security advisory. Downstream packages that statically link mbedtls may require separate rebuilds or upgrades. If upgrading immediately is not possible, assess which services on the affected system depend on libmbedtls and consider restricting network access to those services as a compensating control - noting this does not address local attack vectors if applicable. No specific workaround is available given the undisclosed vulnerability details. Monitor the Mbed TLS upstream project (trustedfirmware.org) and Alpine's security tracker for additional guidance.