CVE-2024-34702

What it actually does

X.509 name constraint validation in the Botan library performs quadratic work relative to the number of SubjectAlternativeName entries and name constraints, allowing remote CPU exhaustion via a crafted certificate chain.

Why it matters to the business

Applications that accept untrusted certificate chains may experience denial of service and resource exhaustion; the issue has been public for over two years with low exploitability and no observed in-the-wild use.

How an attack unfolds

An attacker crafts a certificate chain containing a large number of names in the SubjectAlternativeName extension, signed by a CA certificate that also contains many name constraints, and presents it during TLS or certificate validation; the quadratic algorithm causes excessive CPU consumption leading to service degradation or outage.

How to fix it

Upgrade to Botan 3.5.0 or later, or apply the partial backport present in 2.19.5. For the GIT repository, update to commit 935055e839794a076d209c9e9a1e9cd2255aae01 or newer. Rebuild and redeploy all dependent applications after the library update.

How to confirm the fix worked

Confirm the installed Botan version is 3.5.0+, 2.19.5+, or contains commit 935055e. Exercise certificate validation paths with large name-constraint test vectors and verify that processing time remains linear.

Typical attack path

1. Identify a target service that uses Botan for X.509 certificate validation and accepts client or server certificates.
2. Generate or obtain a CA certificate containing a large number of name constraints.
3. Create an end-entity certificate with a very large number of SubjectAlternativeName entries.
4. Present the malicious certificate chain during the TLS handshake or certificate processing path.
5. Observe resource exhaustion on the target as the quadratic validation routine consumes CPU.

How to detect it

Look in application and system logs for unusually long certificate validation times or spikes in CPU usage coinciding with incoming TLS connections; correlate with services that embed Botan for certificate handling.

What your security team should do

• Prioritize upgrade of Botan to a fixed version in all products that perform X.509 validation.
• Review dependency manifests and rebuild pipelines to ensure the patched library is used.
• Monitor CPU and memory usage on services that process external certificates while the upgrade is pending.
• Add automated dependency scanning to detect future vulnerable versions of Botan.