Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Mbed-TLS/mbedtls

              development @ 522e2e4
            

276

Fixes

CVEs

CRITICAL

Peak severity

58.6%

Coverage

Highlights

Buffer Overflow: 80 prior fixes. Scrutinize any change in this area.

library/ssl_tls.c: most-fixed (44 issues). Treat as high-risk during review.

203 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Buffer Overflow: Multiple buffer overflows in TLS session save/load, CID handling, and MAC computation, often due to missing length checks before memcpy.

Auth Bypass: Critical authentication bypasses in PSK binder validation and early data acceptance, with inverted logic and missing checks.

Buffer Overflow: Recurring buffer overflows in PSA sign/hash/verify operations due to missing bounds checks on hash lengths and output buffers.