CVE-2026-34582: botan_project botan
Vulnerability summary
CVE-2026-34582 is a critical (CVSS 9.1) vulnerability in botan_project botan. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.6% of scored vulnerabilities.
Timeline
- 07-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
+0.15 pp
From 0.23% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-841Improper Enforcement of Behavioral WorkflowThe product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
- CWE-166Improper Handling of Missing Special ElementThe product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Affected systems
Ubuntu2 products
- botanAll versions (No fix recorded)
- botan3All versions (No fix recorded)
Alpine1 product
- botan3< 3.11.1-r0
Botan_project1 product
- botan≥ 3.0.0, ≤ 3.11.0
Debian1 product
- botan3< 3.11.0+dfsg-2
Opensuse1 product
- Botan&distro=openSUSE Leap 16.0< 3.7.1-160000.3.1
Randombit1 product
- botan< 3.11.1
6 vendors · 7 products
References
11 links- github.com/randombit/botan/security/advisories/GHSA-pxcj-9ppx-g86gX Refsource CONFIRMREPORTMitigationVendor Advisory
