PT-2026-31028 · Botan · Botan

Ben Smyth · Published 2026-04-07 · Updated 2026-04-14 · CVE-2026-34582

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.11.1

Description The TLS 1.3 implementation in Botan allowed processing of ApplicationData records before the Finished message was received. This could allow a client to bypass server-enforced client authentication via certificates by omitting the Certificate, CertificateVerify, and Finished messages and instead sending application data records.

Recommendations Update to version 3.11.1 or later.

Fix

Weakness Enumeration

CWE-841

Related Identifiers

CVE-2026-34582

OPENSUSE-SU-2026:20528-1

Affected Products

Botan

References · 13

• https://github.com/randombit/botan/security/advisories/GHSA-pxcj-9ppx-g86g · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34582 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34582 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20528-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34582 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34582 · Security Note
• https://ubuntu.com/security/CVE-2026-34582 · Vendor Advisory
• https://github.com/randombit/botan/pull/5599 · Note
• https://twitter.com/CVEnew/status/2041711869367648598 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041709169045098566 · Twitter Post
• https://suse.com/security/cve/CVE-2026-34582 · Note
• https://bugzilla.suse.com/1261880 · Note