mbedtls CVE-2025-59438

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:13 vuln.today

DescriptionCVE.org

Alpine Linux: mbedtls fixed in 3.6.5-r0

AnalysisAI

mbedtls on Alpine Linux was patched in package version 3.6.5-r0, addressing an unspecified vulnerability. The nature, root cause, and attack surface of the flaw are not disclosed in available intelligence - the CVE record contains only an Alpine Linux changelog-style description with no technical detail. EPSS sits at 0.04% (14th percentile), indicating very low probability of exploitation in the near term. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

mbedtls (formerly PolarSSL) is a lightweight, portable TLS and cryptography library widely used in embedded systems, IoT devices, and resource-constrained environments. It implements TLS 1.2/1.3, X.509 certificate parsing, and common symmetric/asymmetric cryptographic primitives. Alpine Linux packages mbedtls independently, and the fix version 3.6.5-r0 refers to the Alpine package release (apk) rather than an upstream mbedtls release version. No CWE classification is available, so the root cause class - whether cryptographic weakness, memory corruption, input validation failure, or other - cannot be determined from available data. No CPE strings were provided in the input intelligence.

Affected ProductsAI

mbedtls as packaged by Alpine Linux in versions prior to 3.6.5-r0 is confirmed affected per the Alpine vendor. The exact upstream mbedtls version range corresponding to Alpine package 3.6.5-r0 is not independently confirmed from available data. No CPE strings were provided. Users of Alpine Linux who have mbedtls installed should verify their installed package version using 'apk info mbedtls' and consult the Alpine Linux security tracker for the canonical advisory.

RemediationAI

Upgrade the Alpine Linux mbedtls package to version 3.6.5-r0 or later using 'apk upgrade mbedtls'. This is the only confirmed fix identified from available data; no upstream mbedtls advisory URL was provided in the intelligence sources. If immediate patching is not feasible and the vulnerability class were known, targeted compensating controls could be applied - however, because the root cause and attack surface are undisclosed, no specific workaround can be responsibly recommended without risking false assurance. Monitor the Alpine Linux security tracker and the official mbedtls GitHub repository for additional technical detail and upstream advisory publication.