CVE-2026-44378: Botan: Quadratic complexity decoding BER indefinite length encodings
Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44378?
The severity of CVE-2026-44378 is rated as medium with a CVSS score of 6.9.
How do I fix CVE-2026-44378?
To fix CVE-2026-44378, update Botan to version 3.12.0 or later, which addresses the parsing vulnerabilities.
What impact does CVE-2026-44378 have on systems using Botan?
CVE-2026-44378 can lead to denial of service due to quadratic complexity decoding when processing certain BER indefinite length encodings.
Which versions of Botan are affected by CVE-2026-44378?
CVE-2026-44378 affects all versions of Botan prior to 3.12.0.
Is CVE-2026-44378 exploitable remotely?
Yes, CVE-2026-44378 can be exploited remotely as the vulnerability arises from the parsing behavior of data inputs.