AZL-112403: CVE-2026-118767 affecting package botan2 2.14.0-2

Q: Which applications are exposed to this issue?

Applications using Botan's Python binding with bcrypt or check_bcrypt may be affected if they accept Python strings that can contain an embedded U+0000 character. The issue does not affect scrypt or argon2.

Q: What does an attacker need to exploit the flaw?

An attacker needs to supply a password containing an embedded U+0000 character to an affected application. If the application validates the full password but hashes it with bcrypt, Botan may process only the portion before the NUL, enabling a password-policy bypass.

Q: Are default installations of the C++ library affected?

The described issue is in Botan's Python binding, not in general use of the C++ library. Exposure depends on use of the Python binding together with bcrypt or check_bcrypt.

Q: What can be done if upgrading is not immediately possible?

Reject passwords containing U+0000 before passing them to Botan's bcrypt or check_bcrypt functions. Alternatively, use scrypt or argon2, which are identified as unaffected.

Q: How can I determine whether a deployment is affected?

Check whether the application uses Botan's Python binding and calls bcrypt or check_bcrypt, and whether password input can contain embedded U+0000 characters. Versions from 1.11.22 up to, but not including, 3.13.0 are described as affected.

Published Oct 29, 2026

Updated

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and checkbcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.

Affected Software

1 affected component

azure-linux/botan2<=2.14.0-2

Event History

Oct 29, 2026

Advisory Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118767

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Botan's Python binding with bcrypt or check_bcrypt may be affected if they accept Python strings that can contain an embedded U+0000 character. The issue does not affect scrypt or argon2.

What does an attacker need to exploit the flaw?

An attacker needs to supply a password containing an embedded U+0000 character to an affected application. If the application validates the full password but hashes it with bcrypt, Botan may process only the portion before the NUL, enabling a password-policy bypass.

Are default installations of the C++ library affected?

The described issue is in Botan's Python binding, not in general use of the C++ library. Exposure depends on use of the Python binding together with bcrypt or check_bcrypt.

What can be done if upgrading is not immediately possible?

Reject passwords containing U+0000 before passing them to Botan's bcrypt or check_bcrypt functions. Alternatively, use scrypt or argon2, which are identified as unaffected.

How can I determine whether a deployment is affected?

Check whether the application uses Botan's Python binding and calls bcrypt or check_bcrypt, and whether password input can contain embedded U+0000 characters. Versions from 1.11.22 up to, but not including, 3.13.0 are described as affected.

AZL-112403: CVE-2026-118767 affecting package botan2 2.14.0-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the flaw?

Are default installations of the C++ library affected?

What can be done if upgrading is not immediately possible?

How can I determine whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the flaw?

Are default installations of the C++ library affected?

What can be done if upgrading is not immediately possible?

How can I determine whether a deployment is affected?