CVE-2021-44732: Arm Mbed TLS

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Affected products

• Arm Mbed TLS: before 2.16.12 (fixed in 2.16.12); from 2.17.0, before 2.28.0 (fixed in 2.28.0)
• Debian Debian Linux: version 10.0 only
• Trustedfirmware Mbed TLS: version 3.0.0 only

Published 2021-12-20. Last modified 2026-06-17.