CVE-2022-35409

FAUCET Score

CVE-2022-35409 is a critical heap-based buffer over-read vulnerability affecting Mbed TLS versions before 2.28.1 and 3.x before 3.2.0, specifically impacting DTLS servers with certain configurations. An unauthenticated attacker can trigger a server crash or potential information disclosure by sending a crafted ClientHello message. With a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, leading to high impact on availability and confidentiality. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the high FAUCET Risk Score of 74/100 indicates its significant potential threat.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 2.28.1CPE matchmatch criteria	cpe:2.3:a:arm:mbed_tls::::::::
		>= 3.0.0, < 3.2.0CPE matchmatch criteria	cpe:2.3:a:trustedfirmware:mbed_tls::::::::
		10.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:10.0:::::::*

CVSS Data

CVSS version used by this source: 3.1

9.1CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.2

CvssVersion

3.1

Exploit Intelligence

EPSS Score

2.12%

Probability of exploitation in next 30 days

EPSS Percentile

80.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0212 is in the 69th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Advisories (1)

microsoft2022-Jul/CVE-2022-35409

An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.

Jul 12, 2022

References

github.com / Mbed-TLS/mbedtls/releases

Release Notes

lists.debian.org / debian-lts-announce/2022/12/msg00036.html

Mailing ListThird Party Advisory

mbed-tls.readthedocs.io / en/latest/security-advisories/advisories/mbedtls-security-advisory-2022-07.html

ExploitMitigationVendor Advisory