CVE-2026-34580
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In the Botan C++ cryptography library version 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it returned true if any certificate in the store had a matching DN (and subject key identifier, if set) but did not check if the certificates were identical. In 3.11.0, path validation logic was extended assuming certificate_known only returns true for identical certificates. As a result, an end entity certificate with a DN matching a trusted root is accepted as a trusted root. This vulnerability is fixed in version 3.11.1.
Risk Assessment
An attacker can present a fraudulent end entity certificate that is accepted as a trusted root, potentially compromising communication security.
Recommendation
Update the Botan library to version 3.11.1.
Other vulnerabilities in Botan
See all- CVE-2015-7825High
Botan before 1.11.22 improperly validates certificate paths, allowing remote attackers to cause a denial of service via a certificate with a loop in the certificate chain.
- CVE-2015-7824High
Botan versions 1.11.x before 1.11.22 are vulnerable to a padding-oracle attack that allows remote attackers to decrypt TLS ciphertext data using CBC ciphersuites.
- CVE-2016-2850High
Botan versions 1.11.x before 1.11.29 do not enforce TLS policy for signature algorithms and ECC curves, allowing remote attackers to conduct downgrade attacks.
- CVE-2016-2849High
Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.
- CVE-2016-2194High
The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.
- CVE-2015-7827High
Botan before 1.10.13 and 1.11.x before 1.11.22 makes it easier for remote attackers to conduct million-message attacks by measuring time differences related to decoding of PKCS#1 padding.
- CVE-2015-5727High
The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
- CVE-2015-5726High
The BER decoder in Botan versions 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause an application crash via an empty BIT STRING in ASN.1 data.
- CVE-2014-9742High
The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, making it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.
- CVE-2026-34582Critical
In Botan's TLS 1.3 implementation before version 3.11.1, ApplicationData records can be processed before the Finished message is received. This allows a client to bypass certificate-based authentication.
Original NVD description (English source)
Botan is a C++ cryptography library. In 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it would return true if any certificate in the store had a DN (and subject key identifier, if set) matching that of the argument. It did not check that the cert it found and the cert it was passed were actually the same certificate. In 3.11.0 an extension of path validation logic was made which assumed that certificate_known only returned true if the certificates were in fact identical. The impact is that if an end entity certificate is presented, and its DN (and subject key identifier, if set) match that of any trusted root, the end entity certificate is accepted immediately as if it itself were a trusted root. , This vulnerability is fixed in 3.11.1.