PT-2026-42855 · Botan · Botan

Yt Sun · CVE-2026-44378 · Published 2026-05-12 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.12.0

Description Certain patterns of indefinite length encodings in Basic Encoding Rules (BER) data can cause quadratic behavior in the parser, leading to a denial of service. These BER encodings were accepted even in structures required to be encoded as Distinguished Encoding Rules (DER), which specifically prohibit indefinite length encodings.

Recommendations Update to version 3.12.0.

Exploit

Fix

DoS

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-44378

GHSA-7Q2V-3G27-6G3J

Affected Products

Botan

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44378.json · Exploit
• https://github.com/randombit/botan/security/advisories/GHSA-7q2v-3g27-6g3j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44378 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44378 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44378 · Security Note
• https://ubuntu.com/security/CVE-2026-44378 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44378 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44378 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44378 · Vendor Advisory
• https://t.me/cveNotify/165634 · Telegram Post
• https://twitter.com/dailycve/status/2061857603307569427 · Twitter Post