PT-2026-42855 · Botan · Botan

Yt Sun · Published 2026-05-12 · Updated 2026-05-27 · CVE-2026-44378

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.12.0

Description Certain patterns of indefinite length encodings in Basic Encoding Rules (BER) data can cause quadratic behavior in the parser, leading to a denial of service. These BER encodings were accepted even in structures required to be encoded as Distinguished Encoding Rules (DER), which specifically prohibit indefinite length encodings.

Recommendations Update to version 3.12.0.

Fix

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-44378

Affected Products

Botan

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-44378 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44378 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44378 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44378 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44378 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44378 · Vendor Advisory
• https://github.com/randombit/botan/security/advisories/GHSA-7q2v-3g27-6g3j · Note