CVE-2026-34582: Botan Project Botan

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.

Affected products

• Botan Project Botan: from 3.0.0, up to and including 3.11.0

Published 2026-04-07. Last modified 2026-07-24.