CVE-2025-54764

Published Oct 20, 2025

Last updated a year ago

CVSS medium 6.2
Tls

Overview

Description
Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.
Source
cve@mitre.org
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.2
Impact score
3.6
Exploitability score
2.5
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity
MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-208

Social media

Hype score
Not currently trending

  1. CVE-2025-54764 Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. https://t.co/d02O9kqArQ

    @CVEnew

    20 Oct 2025

    286 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Citrix NetScaler Improper Input Validation Vulnerability•CVE-2026-88771
  2. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability•CVE-2026-88772
  3. F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability•CVE-2026-94127
  4. OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.•CVE-2026-81871
  5. Check Point Multiple Products Improper Certificate Validation Vulnerability•CVE-2026-85102

References

Sources include official advisories and independent security research.