CVE-2022-46393: Arm Mbed TLS

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.

Affected products

• Arm Mbed TLS: before 2.28.2 (fixed in 2.28.2)
• Fedoraproject Fedora: version 36 only; version 37 only
• Trustedfirmware Mbed TLS: from 3.0.0, before 3.3.0 (fixed in 3.3.0)

Published 2022-12-15. Last modified 2026-06-17.