CVE-2021-40529: Botan Project Botan

Medium severity, CVSS 5.9. EPSS: 1.5% chance of exploitation in the next 30 days.

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Affected products

• Botan Project Botan: up to and including 2.18.1
• Fedoraproject Fedora: version 34 only; version 35 only
• Mozilla Thunderbird: before 91.12.0 (fixed in 91.12.0)

Published 2021-09-06. Last modified 2026-06-17.