CVE-2026-34582
Botan has a TLS 1.3 certificate authentication bypass
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
| CWE | CWE-841 |
| Vendor | randombit |
| Product | botan |
| Published | Apr 7, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for randombit botan
Be the first to know when new critical vulnerabilities affecting randombit botan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
randombit / botan
< 3.11.1
References
github.com: https://github.com/randombit/botan/security/advisories/GHSA-pxcj-9ppx-g86g access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-34582 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2456285 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34582.json