Mbed TLS CVE-2025-54764

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:14 vuln.today

DescriptionCVE.org

Alpine Linux: mbedtls fixed in 3.6.5-r0

AnalysisAI

Mbed TLS on Alpine Linux has been patched in Alpine package version 3.6.5-r0 to address an unspecified vulnerability. The underlying flaw, root cause, and exploitability conditions have not been publicly disclosed by Alpine or upstream maintainers at the time of analysis. No CVSS score, CWE classification, or technical description is available, making precise impact assessment impossible without additional vendor communication. No public exploit identified at time of analysis, and EPSS score of 0.02% (7th percentile) indicates very low community-assessed exploitation probability.

Technical ContextAI

Mbed TLS (formerly PolarSSL) is an open-source cryptographic library providing TLS/SSL protocol implementation, X.509 certificate handling, and symmetric/asymmetric cryptographic primitives, commonly used in embedded systems, IoT devices, and lightweight server environments. Alpine Linux packages it as 'mbedtls', and the fix is delivered via Alpine's apk package management system at version 3.6.5-r0. No CWE classification is available, so the vulnerability class - whether memory corruption, cryptographic weakness, protocol flaw, or logic error - cannot be confirmed from available data. No CPE strings were provided to further narrow affected configurations.

Affected ProductsAI

Alpine Linux systems running the mbedtls package prior to version 3.6.5-r0 are affected. The specific upstream Mbed TLS library version that introduced or contains the flaw is not identified from available data. No CPE strings were provided to further scope the affected product range. Administrators should consult the Alpine Linux security advisories and the Alpine package tracker for mbedtls to confirm their exposure.

RemediationAI

Upgrade the mbedtls Alpine Linux package to version 3.6.5-r0 or later using 'apk upgrade mbedtls' on affected Alpine Linux systems. This is the vendor-confirmed fix per Alpine's security report. Downstream applications that statically link Mbed TLS rather than consuming it as a shared library must be recompiled against the patched version separately - package upgrade alone will not remediate statically linked binaries. No workarounds or compensating controls are documented because the vulnerability's technical nature has not been publicly disclosed. If upgrading immediately is not possible and the vulnerability class becomes known to involve network-exposed TLS endpoints, consider restricting access to services using mbedtls as a temporary measure, accepting the trade-off of reduced service availability.