diff --git a/library/pk.c b/library/pk.c
index b48b6cb23f..44cdc5be2e 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -1443,6 +1443,7 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type,
                                        sig, sig_size, sig_len);
 #else /* MBEDTLS_USE_PSA_CRYPTO */
 
+#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
     if (ctx->pk_info->type == MBEDTLS_PK_RSA_ALT) {
         mbedtls_rsa_alt_context *rsa_alt = ctx->pk_ctx;
         mbedtls_rsa_context *rsa = (mbedtls_rsa_context *)rsa_alt->key;
@@ -1452,6 +1453,7 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type,
                                 sig, sig_size, sig_len, f_rng, p_rng);
         }
     }
+#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
 
     if (sig_size < mbedtls_pk_get_len(ctx)) {
         return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL;
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 1185b0b283..1bb366d692 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1478,6 +1478,12 @@ void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl,
 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
     size_t in_buf_len = ssl->in_buf_len;
     size_t out_buf_len = ssl->out_buf_len;
+/* ESP Change: For dynamic buffer feature, the buffer allocation shall be 
+ * handled on-demand basis and hence skip the memset in this API on the buffer pointers 
+ */
+#elif defined(CONFIG_MBEDTLS_DYNAMIC_BUFFER)
+    size_t in_buf_len = 0;
+    size_t out_buf_len = 0;
 #else
     size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
     size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
diff --git a/sbom.yml b/sbom.yml
index e15b1d53e1..ef39887fd7 100644
--- a/sbom.yml
+++ b/sbom.yml
@@ -7,6 +7,10 @@ cve-keywords:
   - mbed tls
   - mbedtls
 cve-exclude-list:
+  - cve: CVE-2025-54764
+    reason: Fixed in 3.6.5
+  - cve: CVE-2025-59438
+    reason: Fixed in 3.6.5
   - cve: CVE-2025-52496
     reason: Fixed in 3.6.4
   - cve: CVE-2025-27810