Detections
Analytics
Alpine: multiple mbedtls packages: security update to 3.6.6-r0
high Tenable Cloud Security Plugin ID 439593
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6()
function (CVE-2026-25833)
- Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade. (CVE-2026-25834)
- Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator
(PRNG). (CVE-2026-25835)
Solution
Update the mbedtls library and its related packages to version 3.6.6-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-25833
Plugin Details
Severity: High
ID: 439593
Version: Revision 1.12
Type: Local
Published: 4/1/2026
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.65
CVSS v3
Risk Factor: High
Base Score: 7.7
Temporal Score: 6.7
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2026-25835
Vulnerability Information
Exploit Ease: No known exploits are available