CVE-2015-7826: Botan Project Botan

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.

Affected products

• Botan Project Botan: up to and including 1.11.21

Published 2017-04-10. Last modified 2026-06-17.