Inefficient Algorithmic Complexity in Botan - CVE-2026-44378

Vulnerability identifier: #VU130440

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44378

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the BER parser when parsing indefinite length encodings in ASN.1 encoded data. A remote attacker can send specially crafted ASN.1 data to cause a denial of service.

This can be triggered with ASN.1 encoded inputs such as an X.509 certificate or OCSP response.

Botan
Debian Linux
openEuler
Fedora
botan2-doc
python3-botan2
botan2-devel
botan2-debugsource
botan2-debuginfo
botan2
botan3 (Debian package)
botan3

Install security update from vendor's website.

Botan - update to 3.12.0
botan2-doc - addressed in versions 2.19.3-6, 2.19.3-7
python3-botan2 - addressed in versions 2.19.3-6, 2.19.3-7
botan2-devel - addressed in versions 2.19.3-6, 2.19.3-7
botan2-debugsource - addressed in versions 2.19.3-6, 2.19.3-7
botan2-debuginfo - addressed in versions 2.19.3-6, 2.19.3-7
botan2 - addressed in versions 2.19.3-6, 2.19.3-7
botan3 (Debian package) - update to 3.12.0+dfsg-2~deb13u1
botan3 - update to 3.12.0-1.fc46

• https://github.com/randombit/botan/security/advisories/GHSA-7q2v-3g27-6g3j

• Inefficient Algorithmic Complexity in Botan
• Debian update for botan3
• Fedora 46 update for botan3
• openEuler 24.03 LTS SP3 update for botan2
• openEuler 24.03 LTS SP1 update for botan2
• openEuler 22.03 LTS SP4 update for botan2
• openEuler 24.03 LTS SP4 update for botan2