CVE-2026-118767: Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs
Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and checkbcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Botan's Python binding for bcrypt password hashing or verification are affected if they accept passwords containing the U+0000 character. The issue affects Botan versions from 1.11.22 up to, but not including, 3.13.0; scrypt and argon2 are unaffected.
What does an attacker need to exploit the flaw?
An attacker needs to supply a password containing an embedded U+0000 character to an application that uses the affected Python bcrypt APIs. The application must validate the full Python string while Botan bcrypt processes only the portion before the NUL.
What is the practical impact?
An attacker may bypass application password policies by providing a longer password whose effective bcrypt value is only the prefix before the embedded NUL. Confidentiality and integrity impact are rated low, while availability is not affected.
What should teams do if they cannot immediately upgrade?
Reject passwords containing U+0000 before passing them to Botan's bcrypt or check_bcrypt APIs. Upgrade to Botan 3.13.0 when possible.