PT-2026-29126 · Botan · Botan

Harutokimura · Published 2026-03-30 · Updated 2026-04-20 · CVE-2026-32884

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.11.0

Description Botan is a C++ cryptography library. When processing X.509 certificate paths with DNS name constraints, a case-sensitive comparison of the Common Name (CN) allowed a certificate to bypass restrictions. Specifically, if an end-entity certificate lacked Subject Alternative Names, Botan incorrectly checked the CN against DNS name constraints, failing to account for mixed-case CNs. This allowed a certificate with a mixed-case CN, like Sub.EVIL.COM, to bypass an excludedSubtrees constraint for evil.com. This behavior violates RFC 5280 standards.

Recommendations Update to version 3.11.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-32884

GHSA-7C3G-7763-GGJ5

OPENSUSE-SU-2026:20566-1

Affected Products

Botan

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32884.json · Exploit
• https://github.com/randombit/botan/security/advisories/GHSA-7c3g-7763-ggj5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32884 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20566-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32884 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32884 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32884 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32884 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32884 · Security Note
• https://suse.com/security/cve/CVE-2026-32884 · Note
• https://twitter.com/cyberbivash/status/2038734059652645220 · Twitter Post
• https://bugzilla.suse.com/1261993 · Note
• https://twitter.com/CVEnew/status/2038916081793089706 · Twitter Post