CVE-2026-32884: Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)
Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by the DNS name constraints, even though this check is technically not required by RFC 5280. However this check failed to account for the possibility of a mixed-case CN. Thus a certificate with CN=Sub.EVIL.COM and no subject alternative name would bypasses an excludedSubtrees constraint for evil.com because the comparison is case-sensitive. This issue has been patched in version 3.11.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32884?
CVE-2026-32884 has been classified with a severity that indicates it poses a significant security risk due to its potential exploitation.
How do I fix CVE-2026-32884?
To fix CVE-2026-32884, upgrade Botan to version 3.11.0 or later as it contains the necessary patches.
What software is affected by CVE-2026-32884?
CVE-2026-32884 affects Botan versions prior to 3.11.0.
What type of vulnerability is CVE-2026-32884?
CVE-2026-32884 is a case-insensitive CN values bypass vulnerability violating RFC 5280 guidelines.
What are the potential impacts of CVE-2026-32884?
The potential impacts of CVE-2026-32884 include unauthorized access and bypass of DNS name constraints in cryptographic operations.