CVE-2026-44378
High · 7.5CVSS
7.5
EPSS
0.5%
Published
May 27, 2026
CISA due date
—
The record
Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure will result… CWE-407
- CVE-2026-112894 Pillow is a Python imaging library. CWE-407
- CVE-2026-112891 Pillow is a Python imaging library. CWE-407
- CVE-2026-112401 Pillow is a Python imaging library. CWE-407
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-407
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-407
- CVE-2026-95838 containerd is an open-source container runtime. CWE-407
- CVE-2026-104844 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does… CWE-407