CVE-2026-118767

The record

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.

Affected packages

Related vulnerabilities

• CVE-2026-116566 socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters… CWE-158
• CVE-2026-76354 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-158
• CVE-2026-47778 Envoy is an open source edge and service proxy designed for cloud-native applications. CWE-158
• CVE-2026-43895 jq is a command-line JSON processor. CWE-158
• CVE-2026-41256 jq is a command-line JSON processor. CWE-158
• CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… CWE-158
• CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. CWE-158
• CVE-2026-23863 An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709… CWE-158