JLSEC-2025-211

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-211.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-211.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2025-211

Upstream

CVE-2020-36476

Published

2025-11-21T15:59:04.054Z

Modified

2026-07-25T18:23:56.838204324Z

Severity

5.0 (Medium) CVSS_V2 - AV:N/AC:L/Au:N/C:N/I:P/A:N CVSS Calculator
7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS)

Details

An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.

Database specific

{
    "sources": [
        {
            "modified": "2026-06-17T03:15:34.427Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-36476",
            "id": "CVE-2020-36476",
            "database_specific": {
                "status": "Modified"
            },
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36476",
            "imported": "2026-07-17T20:45:30.793Z",
            "published": "2021-08-23T02:15:06.987Z"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / MbedTLS_jll

Package

Name: MbedTLS_jll
Purl: pkg:julia/MbedTLS_jll?uuid=c8ffd9c3-330d-5841-b78e-0817d7145fa1

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.16.8+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-211.json"