CVE-2021-44732

CRITICAL 9.8CVE-2021-44732 · Published 20/12/2021 · updated 17/06/2026

In short

CVE-2021-44732 is a CRITICAL (CVSS 9.8) vulnerability affecting mbed tls (arm), mbed tls (trustedfirmware).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
Fix: update to 2.28.0, 2.16.12 or later.

Package	Affected versions	Patched versions
mbed tls arm	`≥ 2.17.0, < 2.28.0< 2.16.12`	`2.28.02.16.12`
mbed tls trustedfirmware	`= 3.0.0`	No fix yet

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 2.17.0, < 2.28.0< 2.16.12

2.28.02.16.12

= 3.0.0

No fix yet

More vulnerabilities in mbed tls

See all →