Is CVE-2026-34582 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34582 being exploited in the wild.

How severe is CVE-2026-34582?

Critical severity, with a CVSS score of 9.1, published 7 April 2026.

Which products and versions are affected?

randombit Botan >= 3.0.0, < 3.11.1; Red Hat Red Hat Enterprise Linux 10 Affected.

Is there a fix for CVE-2026-34582?

A patch was published on 2026-04-07: Fixed in version 3.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34582 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34582?

Check whether you run Botan Project Botan. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34582: Botan TLS 1.3 client authentication bypass

Q: Is there a fix for CVE-2026-34582?

A patch was published on 2026-04-07: Fixed in version 3.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34582 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-34582?

Check whether you run Botan Project Botan. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34582 · Severity: critical · CVSS 9.1 · Published 2026-04-07

Botan is a widely used software library that provides cryptographic functions for securing communications. A flaw in its implementation of the TLS 1.3 protocol allows an attacker to bypass mandatory security checks that verify a user's identity. This could allow unauthorized individuals to access protected systems or data without providing the required digital certificates.

Technologies: Botan Project Botan. Vendors: Botan Project.

Quick answers

Is CVE-2026-34582 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34582 being exploited in the wild.
How severe is CVE-2026-34582?: Critical severity, with a CVSS score of 9.1, published 7 April 2026.
Which products and versions are affected?: randombit Botan >= 3.0.0, < 3.11.1; Red Hat Red Hat Enterprise Linux 10 Affected.
Is there a fix for CVE-2026-34582?: A patch was published on 2026-04-07: Fixed in version 3.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34582 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34582?: Check whether you run Botan Project Botan. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Botan's TLS 1.3 stack due to improper enforcement of the handshake behavioral workflow (CWE-841). The implementation allowed the processing of ApplicationData records before the Finished message was received and verified. An unauthenticated remote attacker can exploit this by omitting the Certificate, CertificateVerify, and Finished messages during the handshake. This effectively bypasses mutual TLS (mTLS) authentication, allowing the attacker to submit application-layer data to a server that requires client certificate authentication. The issue is resolved in Botan version 3.11.1.

Affected products

randombit Botan >= 3.0.0, < 3.11.1
Red Hat Red Hat Enterprise Linux 10 Affected

Timeline

2026-04-07: disclosed
2026-04-07: advisory: Vendor advisory GHSA-pxcj-9ppx-g86g published
2026-04-07: patched: Fixed in version 3.11.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.