Botan Project Botan vulnerabilities

• botan project botan Botan: Quadratic complexity decoding BER indefinite length encodings CVE-2026-44378 Fix available 6.9 MediumMay 27, 2026
• botan project botan, red hat enterprise linux 10 +1 more Botan has a TLS 1.3 certificate authentication bypass CVE-2026-34582 Fix available 8.7 HighApril 7, 2026
• botan project botan, red hat enterprise linux 10 +1 more Botan has a certificate authentication bypass due to trust anchor confusion CVE-2026-34580 Fix available 9.3 CriticalApril 7, 2026
• botan project botan Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field CVE-2026-32877 Fix available 8.2 HighMarch 30, 2026
• botan project botan Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass CVE-2026-32883 Fix available 5.9 MediumMarch 30, 2026
• botan project botan Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation) CVE-2026-32884 Fix available 5.9 MediumMarch 30, 2026
• botan project botan Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent... CVE-2024-50383 Fix available 5.9 MediumOctober 23, 2024
• botan project botan Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent... CVE-2024-50382 Fix available 5.9 MediumOctober 23, 2024
• botan project botan Botan has an Authorization Error due to Name Constraint Decoding Bug CVE-2024-39312 Fix available 5.3 MediumJuly 8, 2024
• botan project botan bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length... CVE-2017-7252 7.5 HighNovember 3, 2023
• botan project botan CVE-2022-43705 affecting package botan2 2.14.0-2 CVE-2022-43705 Fix available 9.1 CriticalNovember 23, 2022
• botan project botan, mozilla thunderbird, fedoraproject fedora +2 more The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products,... CVE-2021-40529 Fix available 5.9 MediumSeptember 6, 2021
• botan project botan In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding... CVE-2021-24115 Fix available 9.8 CriticalFebruary 22, 2021
• botan project botan A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely... CVE-2018-20187 Fix available 5.9 MediumMarch 8, 2019
• botan project botan Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA... CVE-2018-12435 Fix available 5.9 MediumJune 15, 2018
• botan project botan An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when... CVE-2018-9860 Fix available 7.5 HighApril 12, 2018
• botan project botan Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept... CVE-2018-9127 Fix available 9.8 CriticalApril 2, 2018
• botan project botan, debian linux +1 more A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1... CVE-2017-14737 Fix available 5.5 MediumSeptember 26, 2017
• botan project botan A programming error exists in a way Randombit Botan cryptographic library version 2.0.1... CVE-2017-2801 Fix available 6.5 MediumApril 25, 2017
• botan project botan The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers... CVE-2016-6879 7.5 HighApril 10, 2017
• botan project botan The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type,... CVE-2016-6878 9.8 CriticalApril 10, 2017
• botan project botan botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might... CVE-2015-7826 9.8 CriticalApril 10, 2017
• botan project botan botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to... CVE-2015-7825 7.5 HighApril 10, 2017
• botan project botan botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data... CVE-2015-7824 7.5 HighApril 10, 2017
• botan project botan In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which... CVE-2016-9132 Fix available 9.8 CriticalJanuary 16, 2017
• botan project botan In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable... CVE-2016-8871 6.2 MediumOctober 28, 2016
• botan project botan, fedoraproject fedora +1 more Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC... CVE-2016-2850 7.5 HighMay 13, 2016
• botan project botan Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows... CVE-2016-2196 9.8 CriticalMay 13, 2016
• botan project botan, debian linux, fedoraproject fedora +2 more Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a... CVE-2016-2849 Fix available 7.5 HighApril 30, 2016
• botan project botan, debian linux, fedoraproject fedora +2 more Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct... CVE-2015-7827 Fix available 7.5 HighApril 30, 2016
• botan project botan The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses... CVE-2014-9742 Fix available 7.5 HighApril 30, 2016
• botan project botan, debian linux +1 more Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27... CVE-2016-2195 Fix available 9.8 CriticalMarch 7, 2016
• botan project botan, debian linux +1 more The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to... CVE-2016-2194 Fix available 7.5 HighMarch 7, 2016
• botan project botan, debian linux +1 more The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers... CVE-2015-5727 Fix available 7.5 HighMarch 7, 2016
• botan project botan, debian linux +1 more The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers... CVE-2015-5726 Fix available 7.5 HighMarch 7, 2016