Every CVE Search/ Get API key

CVE-2024-23775

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows...

7.5 HighFix available

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.11%Up 1.1 points since Feb 8, 2024
90%50%10%1%

What each source reports

NVD Score used 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
CVE List 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2024-21228 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
EUVD-2024-21228
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fgff-579x-65fj 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows...

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
GHSA-fgff-579x-65fj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2024-23775 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
ALPINE-CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-47655 7.5

CVE-2024-23775 affecting package hvloader for versions less than 1.0.1-6

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
AZL-47655
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-23775 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
DEBIAN-CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2025-224 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers...

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
JLSEC-2025-224
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-23775 7.5

CVE-2024-23775 in mbedtls - Patched by Root

Root has patched CVE-2024-23775 in the mbedtls package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-23775 7.5

Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().

Record
UBUNTU-CVE-2024-23775
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUSN-8123-1 No score

mbedtls vulnerabilities

It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could possibly use this issue to crash the program. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-44732)

Jonathan Winzig discovered that Mbed TLS incorrectly handled crafted inputs. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS. (CVE-2024-23775)

It was discovered that Mbed TLS incorrectly handled the TLS handshake. A remote attacker could possibly use this issue to break the security guarantees of the TLS handshake. (CVE-2025-27810)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly documented the behavior of a function. Application code relying on the documented behavior might be affected. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2025-47917)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-48965)

It was discovered that Mbed TLS incorrectly handled a race condition. An attacker could possibly use this issue to extract AES keys. (CVE-2025-52496)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled certain invalid input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-52497)

Record
USN-8123-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mbedtls
Alpine:v3.16
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.17
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.18
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.19
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.20
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.21
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.22
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.23
 before 2.28.7-r0
2.28.7-r0
mbedtls
Alpine:v3.24
 before 2.28.7-r0
2.28.7-r0
mbedtls2
Alpine:v3.20
 before 2.28.7-r0
2.28.7-r0
Show 17 moreShow less
Affected packages
PackageAffectedFixed
mbedtls2
Alpine:v3.21
 before 2.28.7-r0
2.28.7-r0
mbedtls2
Alpine:v3.22
 before 2.28.7-r0
2.28.7-r0
mbedtls2
Alpine:v3.23
 before 2.28.7-r0
2.28.7-r0
mbedtls2
Alpine:v3.24
 before 2.28.7-r0
2.28.7-r0
mbedtls3
Alpine:v3.24
 before 2.28.7-r0
2.28.7-r0
hvloader
Azure Linux:2
 before 1.0.1-6
1.0.1-6
mbedtls
Debian:12
 All versions, plus listed versions
2.28.3-12.28.4-12.28.5-12.28.6-12.28.7-1
Show 18 moreShow less
2.28.7-1.12.28.7-1.1~exp12.28.8-13.6.0-13.6.0-23.6.0-33.6.2-13.6.2-23.6.2-33.6.3-13.6.4-13.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.6-0.1~deb13u13.6.7-23.6.7-3
 None known
mbedtls
Debian:13
 before 2.28.7-1
2.28.7-1
mbedtls
Debian:14
 before 2.28.7-1
2.28.7-1
MbedTLS_jll
Julia
 before 2.28.10+0
2.28.10+0
mbedtls
Root:Debian:12
 before 2.28.3-1.root.io.1
2.28.3-1.root.io.12.28.3-1.root.io.142.28.3-1.root.io.62.28.3-1.root.io.22.28.3-1.root.io.52.28.3-1.root.io.42.28.3-1.root.io.92.28.3-1.root.io.72.28.3-1.root.io.102.28.3-1.root.io.152.28.3-1.root.io.32.28.3-1.root.io.162.28.3-1.root.io.82.28.3-1.root.io.112.28.3-1.root.io.122.28.3-1.root.io.132.28.3-1.aikido.17
rootio-mbedtls
Root:Debian:12
 before 2.28.3-1.root.io.1
2.28.3-1.root.io.12.28.3-1.root.io.142.28.3-1.root.io.62.28.3-1.root.io.22.28.3-1.root.io.52.28.3-1.root.io.42.28.3-1.root.io.92.28.3-1.root.io.72.28.3-1.root.io.102.28.3-1.root.io.152.28.3-1.root.io.32.28.3-1.root.io.162.28.3-1.root.io.82.28.3-1.root.io.112.28.3-1.root.io.122.28.3-1.root.io.132.28.3-1.aikido.17
mbedtls
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3
 None known
mbedtls
Ubuntu:Pro:18.04:LTS
 before 2.8.0-1ubuntu0.1~esm1, plus listed versions
2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-1
2.8.0-1ubuntu0.1~esm1
mbedtls
Ubuntu:Pro:20.04:LTS
 before 2.16.4-1ubuntu2+esm1, plus listed versions
2.16.2-12.16.3-12.16.4-1ubuntu2
2.16.4-1ubuntu2+esm1
mbedtls
Ubuntu:Pro:22.04:LTS
 before 2.28.0-1ubuntu0.1~esm1, plus listed versions
2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build1
2.28.0-1ubuntu0.1~esm1
mbedtls
Ubuntu:Pro:24.04:LTS
 before 2.28.8-1ubuntu0.1~esm1, plus listed versions
2.28.3-12.28.6-1ubuntu12.28.7-1ubuntu12.28.7-1.1ubuntu12.28.8-1
2.28.8-1ubuntu0.1~esm1

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23775 is a high vulnerability (CVSS 7.5) in Arm Mbed Tls, published January 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in mbedtls 2.28.7-r0.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open