High severity · published May 27, 2026
CVE-2026-44378
Botan: Quadratic complexity decoding BER indefinite length encodings
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
botan · randombit
< 3.12.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44378
Vendor Advisory
https://github.com/randombit/botan/security/advisories/GHSA-7q2v-3g27-6g3j
More from botan
9.1
CVE-2026-34582
Botan has a TLS 1.3 certificate authentication bypass
8.2
CVE-2026-32877
Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field
7.5
CVE-2026-34580
Botan has a certificate authentication bypass due to trust anchor confusion
5.9
CVE-2026-32883
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
5.9
CVE-2026-32884
Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)