UBUNTU-CVE-2026-48057: Low severity ubuntu/botan vulnerability
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained intermediate CA can issue a certificate with a multi-value RDN whose first Common Name matches the permitted constraint and whose second Common Name is attacker-chosen, causing the constraint check to accept the flattened first value. If the certificate contains no subjectAlternativeName extension, the second Common Name can then be accepted as a hostname; Botan does not fall back to Common Name hostname matching when any subjectAlternativeName is present. The exposure is limited to deployments using DN name constraints, which are uncommon outside internal PKIs, and to certificates without a subjectAlternativeName. This issue is fixed in version 3.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure is limited to deployments that use DN name constraints, which are uncommon outside internal PKIs. The affected certificate must also lack a subjectAlternativeName extension.
What capabilities does an attacker need to exploit it?
The attacker must control a name-constrained intermediate CA. They can then issue a certificate with a multi-value RDN where the first Common Name satisfies the permitted constraint and a second Common Name is attacker-chosen.
Why does the absence of a subjectAlternativeName matter?
When no subjectAlternativeName is present, the attacker-chosen second Common Name can be accepted as a hostname. Botan does not use Common Name hostname matching if any subjectAlternativeName is present.
What version fixes the issue?
The issue is fixed in Botan version 3.13.0.