CVE-2026-44378: falha de média gravidade em randombit botan
Botan: Quadratic complexity decoding BER indefinite length encodings
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
randombit · botanCVEs relacionadas — randombit botan
No mesmo produto, das mais perigosas para as menos.
CVE-2024-34702MEDIUMBotan has a Denial of Service Due to Excessive Name ConstraintsEPSS 0.8%CVE-2024-34703HIGHBotan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve ParametersEPSS 0.5%CVE-2026-34580CRITICALBotan has a certificate authentication bypass due to trust anchor confusionEPSS 0.5%CVE-2026-118769CRITICALBotan: Integer overflow when reporting block size in FFI can cause memory corruptionEPSS 0.4%CVE-2026-32877HIGHBotan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash FieldEPSS 0.3%CVE-2024-39312MEDIUMBotan has an Authorization Error due to Name Constraint Decoding BugEPSS 0.3%