CVE-2022-46393
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap...
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
CVE-2022-46393- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
CVE List
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
CVE-2022-46393- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2022-49202
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
EUVD-2022-49202- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pjwj-r3p9-jjrq
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap...
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
GHSA-pjwj-r3p9-jjrq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
OSV
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
CVE-2022-46393- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-46393
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
DEBIAN-CVE-2022-46393- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVJLSEC-2025-220
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
JLSEC-2025-220- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-46393
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Record
UBUNTU-CVE-2022-46393- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10257-1 No score
Security update for mbedtls
This update for mbedtls fixes the following issues:
- CVE-2022-46393: Fixed potential heap buffer overread and overwrite in DTLS (boo#1206576).
- Record
openSUSE-SU-2022:10257-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12581-1 No score
libmbedcrypto7-2.28.2-1.1 on GA media
These are all security issues fixed in the libmbedcrypto7-2.28.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12581-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11119-1 No score
libeverest-3.6.6-1.1 on GA media
These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11119-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mbedtlsDebian:12 |
before 2.28.2-1 | 2.28.2-1 |
mbedtlsDebian:13 |
before 2.28.2-1 | 2.28.2-1 |
mbedtlsDebian:14 |
before 2.28.2-1 | 2.28.2-1 |
MbedTLS_jllJulia |
before 2.28.2+0 | 2.28.2+0 |
mbedtlsUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3 |
None known |
mbedtlsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1 |
None known |
mbedtlsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build12.28.0-1ubuntu0.1~esm1 |
None known |
mbedtlsSUSE:Package Hub 15 SP4 |
before 2.28.0-bp154.2.3.1 | 2.28.0-bp154.2.3.1 |
mbedtlsopenSUSE:Leap 15.4 |
before 2.28.0-bp154.2.3.1 | 2.28.0-bp154.2.3.1 |
mbedtls-2openSUSE:Tumbleweed |
before 2.28.2-1.1 | 2.28.2-1.1 |
mbedtls-3openSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.6.6-1.1 | 3.6.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-46393 is a critical vulnerability (CVSS 9.8) in Arm Mbed Tls, published December 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in mbedtls 2.28.2-1.
References
mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories
github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCOEEALUHZMFHXQHR6S4QL
nvd.nist.gov/vuln/detail/CVE-2022-46393
Show 23 moreShow less
security-tracker.debian.org/tracker/CVE-2022-46393
ubuntu.com/security/CVE-2022-46393
cve.org/CVERecord?id=CVE-2022-46393
lists.opensuse.org/archives/list/[email protected]/thread/XEUHNTIZA3D3WTCE7CPPFSSECHSABXIG
bugzilla.suse.com/1206576
suse.com/security/cve/CVE-2022-46393