CVE-2020-36475 Denial of service in n/a
Attackers can cause denial of service in Mbed TLS by supplying overly large parameters during Diffie-Hellman key generation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36475?
CVE-2020-36475 is a high-severity denial of service vulnerability in Arm Mbed Tls, published on 23 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.
Weakness: CWE-131
Which versions are affected by CVE-2020-36475?
It affects 8 products.
Products include Arm Mbed Tls, Debian Debian Linux, Siemens Logo\! Cmr2020 Firmware, Siemens Logo\! Cmr2040 Firmware, Siemens Simatic Rtu3000c Firmware, Siemens Simatic Rtu3030c Firmware and 2 more.
How do I fix CVE-2020-36475?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-36475 being exploited?
There is no known exploitation of CVE-2020-36475 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as DEBIAN-CVE-2020-36475, GHSA-7qm6-rr75-xc68, JLSEC-2025-210, UBUNTU-CVE-2020-36475.