CVE-2021-43666

HIGH

mbed TLS < 3.0.0 - Denial of Service in mbedtls_pkcs12_derivation

Title source: llm

Description

A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.

References (3)

Core 3

Core References

Mailing List, Third Party Advisory mailing-list

https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html

Exploit, Issue Tracking, Third Party Advisory

https://github.com/ARMmbed/mbedtls/issues/5136

Mailing List

https://lists.debian.org/debian-lts-announce/2025/06/msg00034.html

Scores

CVSS v3 7.5

EPSS 0.0207

EPSS Percentile 78.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-130

Status published

Products (2)

arm/mbed_tls < 3.0.0

debian/debian_linux 10.0

Published Mar 24, 2022

Tracked Since Feb 18, 2026