CVE-2026-32884 Details
Description
Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by the DNS name constraints, even though this check is technically not required by RFC 5280. However this check failed to account for the possibility of a mixed-case CN. Thus a certificate with CN=Sub.EVIL.COM and no subject alternative name would bypasses an excludedSubtrees constraint for evil.com because the comparison is case-sensitive. This issue has been patched in version 3.11.0.
A vulnerability exists in Botan, a C++ cryptography library, in versions prior to 3.11.0. The issue arises when processing X.509 certificate paths with name constraints that limit allowable DNS names. If the end-entity certificate lacks a subject alternative name, Botan incorrectly verifies that the common name (CN) complies with the DNS name constraints. This check, not mandated by RFC 5280, fails to consider mixed-case CN values. As a result, a certificate with CN=Sub.EVIL.COM and no subject alternative name can circumvent an excludedSubtrees constraint for evil.com, exploiting the case-sensitive comparison. This vulnerability has been addressed in version 3.11.0.
Users can upgrade to Botan version 3.11.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/randombit/botan/security/advisories/GHSA-7c3g-7763-ggj5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| botan project botan | < 3.11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |