CVE-2026-44378 | High | 7.5 | 2026-05-27 | Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser… |
CVE-2026-34582 | Critical | 9.1 | 2026-04-07 | Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished… |
CVE-2026-34580 | High | 7.5 | 2026-04-07 | Botan is a C++ cryptography library. In 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it would return true if any certificat… |
CVE-2026-32884 | Medium | 5.9 | 2026-03-30 | Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of a… |
CVE-2026-32883 | Medium | 5.9 | 2026-03-30 | Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate s… |
CVE-2026-32877 | High | 8.2 | 2026-03-30 | Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C… |
CVE-2024-50383 | Medium | 5.9 | 2024-10-23 | Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-P… |
CVE-2024-50382 | Medium | 5.9 | 2024-10-23 | Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. T… |
CVE-2024-39312 | Medium | 5.3 | 2024-07-08 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2017-7252 | High | 7.5 | 2023-11-03 | bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attacke… |
CVE-2022-43705 | Critical | 9.1 | 2022-11-27 | In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 20… |
CVE-2021-40529 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between tw… |
CVE-2021-24115 | Critical | 9.8 | 2021-02-22 | In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex). |
CVE-2018-20187 | Medium | 5.9 | 2019-03-08 | A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to deri… |
CVE-2018-12435 | Medium | 5.9 | 2018-06-15 | Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, rel… |
CVE-2018-9860 | High | 7.5 | 2018-04-12 | An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving s… |
CVE-2018-9127 | Critical | 9.8 | 2018-04-02 | Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125… |
CVE-2017-14737 | Medium | 5.5 | 2017-09-26 | A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover… |
CVE-2017-2801 | Medium | 6.5 | 2017-05-24 | A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate veri… |
CVE-2016-6879 | High | 7.5 | 2017-04-10 | The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more tha… |
CVE-2016-6878 | Critical | 9.8 | 2017-04-10 | The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors rel… |
CVE-2015-7826 | Critical | 9.8 | 2017-04-10 | botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X… |
CVE-2015-7825 | High | 7.5 | 2017-04-10 | botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and memory consumption)… |
CVE-2015-7824 | High | 7.5 | 2017-04-10 | botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. |
CVE-2016-9132 | Critical | 9.8 | 2017-01-30 | In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API ca… |
CVE-2016-8871 | Medium | 6.2 | 2016-10-28 | In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to r… |
CVE-2016-2850 | High | 7.5 | 2016-05-13 | Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade att… |
CVE-2016-2849 | High | 7.5 | 2016-05-13 | Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow re… |
CVE-2016-2196 | Critical | 9.8 | 2016-05-13 | Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (memory overwrit… |
CVE-2016-2195 | Critical | 9.8 | 2016-05-13 | Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute… |
CVE-2016-2194 | High | 7.5 | 2016-05-13 | The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified inpu… |
CVE-2015-7827 | High | 7.5 | 2016-05-13 | Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to… |
CVE-2015-5727 | High | 7.5 | 2016-05-13 | The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecif… |
CVE-2015-5726 | High | 7.5 | 2016-05-13 | The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application crash) via an empty… |
CVE-2014-9742 | High | 7.5 | 2016-05-13 | The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attacke… |