Improper Certificate Validation in Botan - CVE-2026-34580
Published: April 8, 2026
Vulnerability identifier: #VU125385
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34580
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass X.509 certificate verification.
The vulnerability exists due to improper certificate validation in Certificate_Store::certificate_known and path validation logic when processing a presented end entity certificate. A remote attacker can present a crafted certificate with a distinguished name and subject key identifier matching a trusted root to bypass X.509 certificate verification.
The issue occurs because the certificate lookup logic treated matching certificate attributes as if the certificates were identical, causing the end entity certificate to be accepted as a trusted root.
Affected software
Botan
Fedora
botan3
Fedora
botan3
How to mitigate CVE-2026-34580
Install security update from vendor's website.
Botan - update to 3.11.1
botan3 - addressed in versions 3.9.0-3.el10_3, 3.9.0-4.el10_3, 3.9.0-6.fc44, 3.9.0-7.fc44
botan3 - addressed in versions 3.9.0-3.el10_3, 3.9.0-4.el10_3, 3.9.0-6.fc44, 3.9.0-7.fc44