CVE-2026-34582
Botan has a TLS 1.3 certificate authentication bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
8th
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
| CWE | CWE-841 |
| Vendor | randombit |
| Product | botan |
| Published | Apr 7, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for randombit botan
Be the first to know when new unknown vulnerabilities affecting randombit botan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
randombit / botan
< 3.11.1