DEBIAN-CVE-2026-34582

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-34582

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34582.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-34582

Upstream

CVE-2026-34582

Published

2026-04-07T22:16:22Z

Modified

2026-09-14T17:02:31Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.

References

https://security-tracker.debian.org/tracker/CVE-2026-34582

Affected packages

Debian:13 / botan3

Package

Name: botan3
Purl: pkg:deb/debian/botan3?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.11.0+dfsg-2

Affected versions

3.*

3.7.1+dfsg-2

3.8.1+dfsg-1

3.9.0+dfsg-1

3.9.0+dfsg-2

3.9.0+dfsg-2.1

3.10.0+dfsg-1

3.10.0+dfsg-2

3.11.0+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34582.json"

Debian:14 / botan3