CVE-2026-34582
Critical · 9.1CVSS
9.1
EPSS
0.4%
Published
Apr 7, 2026
CISA due date
—
The record
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | Botan | 0 | 3.7.1-160000.3.1 |
Related vulnerabilities
- CVE-2026-32884 Botan is a C++ cryptography library. Also affects Botan
- CVE-2026-87503 Inappropriate implementation in Downloads in Google Chrome on on Android prior to… CWE-841
- CVE-2026-53637 Sylius is an Open Source eCommerce Framework on Symfony. CWE-841
- CVE-2026-82423 A vulnerability has been found in macrozheng mall up to 1.0.3. CWE-841
- CVE-2026-55763 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-841
- CVE-2026-78618 A business logic flaw in WatchGuard Dimension allows an authenticated administrator to… CWE-841
- CVE-2026-78103 WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. CWE-841
- CVE-2026-77508 Weblate is a web based localization tool. CWE-841