Every CVE Search/ Get API key

CVE-2021-44732

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by...

9.8 CriticalFix available

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.77%Up 1.3 points since Dec 20, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
CVE-2021-44732
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
CVE-2021-44732
Updated
2026-11-02
EUVDEUVD-2021-31547 No score

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
EUVD-2021-31547
Updated
2026-11-02
GitHub AdvisoriesGHSA-7g56-f7p4-fmcq 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by...

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
GHSA-7g56-f7p4-fmcq
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVALPINE-CVE-2021-44732 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
ALPINE-CVE-2021-44732
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
CVE-2021-44732
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-44732 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
DEBIAN-CVE-2021-44732
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2025-214 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an...

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
JLSEC-2025-214
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVUBUNTU-CVE-2021-44732 9.8

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Record
UBUNTU-CVE-2021-44732
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2022-0017 No score

Updated mbedtls packages fix security vulnerability

This update provides Mbed TLS 2.16.12, with a number of bug fixes and a security fix. Mbed TLS has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. (CVE-2021-44732)

Record
MGASA-2022-0017
Updated
2026-11-02
OSVUSN-8123-1 No score

mbedtls vulnerabilities

It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could possibly use this issue to crash the program. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-44732)

Jonathan Winzig discovered that Mbed TLS incorrectly handled crafted inputs. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS. (CVE-2024-23775)

It was discovered that Mbed TLS incorrectly handled the TLS handshake. A remote attacker could possibly use this issue to break the security guarantees of the TLS handshake. (CVE-2025-27810)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly documented the behavior of a function. Application code relying on the documented behavior might be affected. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2025-47917)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-48965)

It was discovered that Mbed TLS incorrectly handled a race condition. An attacker could possibly use this issue to extract AES keys. (CVE-2025-52496)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled certain invalid input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-52497)

Record
USN-8123-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mbedtls
Alpine:v3.12
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.13
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.14
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.15
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.16
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.17
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.18
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.19
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.20
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.21
 before 2.16.12-r0
2.16.12-r0
Show 21 moreShow less
Affected packages
PackageAffectedFixed
mbedtls
Alpine:v3.22
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.23
 before 2.16.12-r0
2.16.12-r0
mbedtls
Alpine:v3.24
 before 2.16.12-r0
2.16.12-r0
mbedtls2
Alpine:v3.20
 before 2.16.12-r0
2.16.12-r0
mbedtls2
Alpine:v3.21
 before 2.16.12-r0
2.16.12-r0
mbedtls2
Alpine:v3.22
 before 2.16.12-r0
2.16.12-r0
mbedtls2
Alpine:v3.23
 before 2.16.12-r0
2.16.12-r0
mbedtls2
Alpine:v3.24
 before 2.16.12-r0
2.16.12-r0
mbedtls3
Alpine:v3.24
 before 2.16.12-r0
2.16.12-r0
mbedtls
Debian:12
 before 2.28.0-0.3
2.28.0-0.3
mbedtls
Debian:13
 before 2.28.0-0.3
2.28.0-0.3
mbedtls
Debian:14
 before 2.28.0-0.3
2.28.0-0.3
mbedtls
Debian:10
 before 2.16.9-0~deb10u1, plus listed versions
2.16.0-12.16.2-12.16.3-12.16.4-12.16.5-1
2.16.9-0~deb10u1
mbedtls
Debian:11
 before 2.16.9-0.1+deb11u1, plus listed versions
2.16.9-0.1
2.16.9-0.1+deb11u1
MbedTLS_jll
Julia
 before 2.28.0+0
2.28.0+0
mbedtls
Mageia:8
 before 2.16.12-1.mga8
2.16.12-1.mga8
mbedtls
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3
 None known
mbedtls
Ubuntu:Pro:18.04:LTS
 before 2.8.0-1ubuntu0.1~esm1, plus listed versions
2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-1
2.8.0-1ubuntu0.1~esm1
mbedtls
Ubuntu:Pro:20.04:LTS
 before 2.16.4-1ubuntu2+esm1, plus listed versions
2.16.2-12.16.3-12.16.4-1ubuntu2
2.16.4-1ubuntu2+esm1
mbedtls
Ubuntu:Pro:22.04:LTS
 before 2.28.0-1ubuntu0.1~esm1, plus listed versions
2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build1
2.28.0-1ubuntu0.1~esm1
mbedtls
Ubuntu:Pro:24.04:LTS
 before 2.28.8-1ubuntu0.1~esm1, plus listed versions
2.28.3-12.28.6-1ubuntu12.28.7-1ubuntu12.28.7-1.1ubuntu12.28.8-1
2.28.8-1ubuntu0.1~esm1

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-44732 is a critical vulnerability (CVSS 9.8) in Arm Mbed Tls, published December 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.77%, the 86th percentile. Fixed in mbedtls 2.16.12-r0.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open