AZL-112409: CVE-2026-118769 affecting package botan2 2.14.0-2

Q: Which applications are realistically exposed to this issue?

Applications are exposed only if they accept external algorithm parameter strings and use Botan's C API through the raw ECB mode. The C++ API and normally used C API modes such as CBC and CTR are unaffected.

Q: What must an attacker be able to control to trigger memory corruption?

An attacker must be able to select an algorithm parameter that causes use of the variable-block-size Lion cipher. This can truncate the block size reported through the C API, leading the caller to allocate too little memory before later block processing.

Q: What can be done if upgrading is not immediately possible?

Avoid using the FFI raw ECB mode with externally controlled algorithm parameters, and prevent selection of the Lion cipher. Use unaffected C API modes such as CBC or CTR where appropriate.

Q: How can I determine whether a deployment is affected?

Review whether the application uses botan_block_cipher_block_size through Botan's C API with raw ECB mode, and whether untrusted input can influence algorithm parameter strings or select Lion. Versions from 2.1.0 through 3.13.0 are affected; the issue is fixed in 3.13.0.

Published Oct 29, 2026

Updated

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botanblockcipherblocksize converted a sizet block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.

Affected Software

1 affected component

azure-linux/botan2<=2.14.0-2

Event History

Oct 29, 2026

Advisory Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118769

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications are exposed only if they accept external algorithm parameter strings and use Botan's C API through the raw ECB mode. The C++ API and normally used C API modes such as CBC and CTR are unaffected.

What must an attacker be able to control to trigger memory corruption?

An attacker must be able to select an algorithm parameter that causes use of the variable-block-size Lion cipher. This can truncate the block size reported through the C API, leading the caller to allocate too little memory before later block processing.

What can be done if upgrading is not immediately possible?

Avoid using the FFI raw ECB mode with externally controlled algorithm parameters, and prevent selection of the Lion cipher. Use unaffected C API modes such as CBC or CTR where appropriate.

How can I determine whether a deployment is affected?

Review whether the application uses botan_block_cipher_block_size through Botan's C API with raw ECB mode, and whether untrusted input can influence algorithm parameter strings or select Lion. Versions from 2.1.0 through 3.13.0 are affected; the issue is fixed in 3.13.0.

AZL-112409: CVE-2026-118769 affecting package botan2 2.14.0-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What must an attacker be able to control to trigger memory corruption?

What can be done if upgrading is not immediately possible?

How can I determine whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What must an attacker be able to control to trigger memory corruption?

What can be done if upgrading is not immediately possible?

How can I determine whether a deployment is affected?