BO
Product
botan
14
CVEs
0
On KEV
9.2
Max CVSS
5
New 30D
Severity mix
Critical 2High 5Medium 7Low 0
Watch
Add botan to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118769 New | 9.2 | Oct 29 | Botan: Integer overflow when reporting block size in FFI can cause memory corruption Affected: >= 2.1.0, < 3.13.0 |
| CVE-2026-34582 | 9.1 | Apr 7 | Botan has a TLS 1.3 certificate authentication bypass Affected: < 3.11.1 |
| CVE-2026-32877 | 8.2 | Mar 30 | Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field Affected: >= 2.3.0, < 3.11.0 |
| CVE-2026-44378 | 7.5 | May 27 | Botan: Quadratic complexity decoding BER indefinite length encodings Affected: < 3.12.0 |
| CVE-2026-34580 | 7.5 | Apr 7 | Botan has a certificate authentication bypass due to trust anchor confusion Affected: >= 3.11.0, < 3.11.1 |
| CVE-2024-34703 | 7.5 | Jun 30 | Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters Affected: >= 3.0.0-alpha0, < 3.3.0; < 2.19.4 |
| CVE-2026-118765 New | 7.3 | Oct 29 | Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state Affected: >= 3.7.0, < 3.13.0 |
| CVE-2026-118766 New | 6.1 | Oct 29 | Botan: Online OCSP redirects enable blind requests to internal HTTP services Affected: < 3.13.0 |
| CVE-2026-118768 New | 5.9 | Oct 29 | Botan: CLI utility `ocsp_check` accepts unauthenticated responses Affected: >= 1.11.34, < 3.13.0 |
| CVE-2026-32883 | 5.9 | Mar 30 | Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass Affected: >= 3.0.0, < 3.11.0 |
| CVE-2026-32884 | 5.9 | Mar 30 | Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation) Affected: < 3.11.0 |
| CVE-2024-39312 | 5.3 | Jul 8 | Botan has an Authorization Error due to Name Constraint Decoding Bug Affected: < 2.19.5; >= 3.0.0, < 3.5.0 |
| CVE-2024-34702 | 5.3 | Jul 8 | Botan has a Denial of Service Due to Excessive Name Constraints Affected: < 2.19.5; >= 3.0.0, < 3.5.0 |
| CVE-2026-118767 New | 4.8 | Oct 29 | Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs Affected: >= 1.11.22, < 3.13.0 |
Showing 14