CVE-2026-34582: Botan has a TLS 1.3 certificate authentication bypass
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
botanto a version that resolves this vulnerability.Fixed in 3.11.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34582?
CVE-2026-34582 has a high severity rating due to the potential for TLS 1.3 certificate authentication bypass.
How do I fix CVE-2026-34582?
To mitigate CVE-2026-34582, upgrade Botan to version 3.11.1 or later, where the vulnerability has been addressed.
What products are affected by CVE-2026-34582?
CVE-2026-34582 affects Botan versions prior to 3.11.1.
What is the main issue of CVE-2026-34582?
The main issue of CVE-2026-34582 is that it allows ApplicationData records to be processed before receiving the Finished message, potentially bypassing client authentication.
Are there any workarounds for CVE-2026-34582?
There are no official workarounds; the recommended solution is to update to the fixed version of Botan.