RSA plaintext recovery via decryption timing oracle

Timing side channel in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2 allows local users to recover RSA plaintext via chosen-ciphertext probes. During blinded RSA decryption, the final modular multiplication and integer-to-byte conversion take input-dependent time, exposing whether high plaintext bits are zero. The attack requires precise local or near-network timing and a large number of decryption messages; it discloses plaintext rather than the private key.