CVE-2026-34580 Details
Description
Botan is a C++ cryptography library. In 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it would return true if any certificate in the store had a DN (and subject key identifier, if set) matching that of the argument. It did not check that the cert it found and the cert it was passed were actually the same certificate. In 3.11.0 an extension of path validation logic was made which assumed that certificate_known only returned true if the certificates were in fact identical. The impact is that if an end entity certificate is presented, and its DN (and subject key identifier, if set) match that of any trusted root, the end entity certificate is accepted immediately as if it itself were a trusted root. , This vulnerability is fixed in 3.11.1.
A vulnerability in Botan version 3.11.0 allows for an X.509 certificate verification bypass. The issue arises in the `Certificate_Store::certificate_known` function, which inaccurately indicates that a certificate is known if its distinguished name (DN) and subject key identifier (if applicable) match those of any certificate in the store. This function does not verify that the certificates are identical. In version 3.11.0, changes to path validation logic incorrectly assumed that `certificate_known` only returned true for identical certificates. As a result, if an end entity certificate's DN (and subject key identifier, if set) matches that of a trusted root, the end entity certificate is accepted as if it were a trusted root, creating a critical trust anchor confusion.
Users can upgrade to Botan version 3.11.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-34580 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2456288 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34580.json | redhat-SADP | |
| https://github.com/randombit/botan/security/advisories/GHSA-v782-6fq4-q827 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | redhat-SADP |
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| botan project botan | 3.11.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |