PT-2026-29126 · Botan · Botan

Harutokimura · Publicado 2026-03-30 · Atualizado 2026-04-20 · CVE-2026-32884

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.11.0

Description Botan is a C++ cryptography library. When processing X.509 certificate paths with DNS name constraints, a case-sensitive comparison of the Common Name (CN) allowed a certificate to bypass restrictions. Specifically, if an end-entity certificate lacked Subject Alternative Names, Botan incorrectly checked the CN against DNS name constraints, failing to account for mixed-case CNs. This allowed a certificate with a mixed-case CN, like Sub.EVIL.COM, to bypass an excludedSubtrees constraint for evil.com. This behavior violates RFC 5280 standards.

Recommendations Update to version 3.11.0 or later.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-32884

GHSA-7C3G-7763-GGJ5

OPENSUSE-SU-2026:20566-1

Produtos afetados

Botan

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32884.json · Exploit
• https://github.com/randombit/botan/security/advisories/GHSA-7c3g-7763-ggj5 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916081793089706 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-32884 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32884 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALPINE-CVE-2026-32884 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2026-32884 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32884 · Nota de Segurança
• https://ubuntu.com/security/CVE-2026-32884 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-32884 · Aviso do Fabricante
• https://bugzilla.suse.com/1261993 · Nota
• https://twitter.com/cyberbivash/status/2038734059652645220 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-32884 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32884 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:20566-1 · Aviso do Fabricante