CVE-2021-43666
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the...
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
CVE-2021-43666- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-130
- Updated
- 2026-11-02
CVE List
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
CVE-2021-43666- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
EUVDEUVD-2021-30578
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
EUVD-2021-30578- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cgwh-hfr7-38m2
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the...
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
GHSA-cgwh-hfr7-38m2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSV
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
CVE-2021-43666- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-43666
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
DEBIAN-CVE-2021-43666- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2025-217
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the...
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
JLSEC-2025-217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-43666
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Record
UBUNTU-CVE-2021-43666- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mbedtlsDebian:12 |
before 2.28.0-1 | 2.28.0-1 |
mbedtlsDebian:13 |
before 2.28.0-1 | 2.28.0-1 |
mbedtlsDebian:14 |
before 2.28.0-1 | 2.28.0-1 |
mbedtlsDebian:10 From an advisory covering 18 CVEs |
before 2.16.9-0~deb10u1, plus listed versions 2.16.0-12.16.2-12.16.3-12.16.4-12.16.5-1 |
2.16.9-0~deb10u1 |
mbedtlsDebian:11 From an advisory covering 5 CVEs |
before 2.16.9-0.1+deb11u1, plus listed versions 2.16.9-0.1 |
2.16.9-0.1+deb11u1 |
MbedTLS_jllJulia |
before 2.28.0+0 | 2.28.0+0 |
mbedtlsUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3 |
None known |
mbedtlsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43666 is a high vulnerability (CVSS 7.5) in Arm Mbed Tls, published March 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in mbedtls 2.28.0-1.
References
github.com/ARMmbed/mbedtls/issues/5136
lists.debian.org/debian-lts-announce/2022/12/msg00036.html
nvd.nist.gov/vuln/detail/CVE-2021-43666
security-tracker.debian.org/tracker/CVE-2021-43666
ubuntu.com/security/CVE-2021-43666
cve.org/CVERecord?id=CVE-2021-43666