Executive brief
Botan is a widely used C++ library that provides cryptographic functions for applications, such as handling digital certificates and secure communications. A flaw in how the library processes certain data formats allows an attacker to send specially crafted files that consume excessive processor power. This can lead to a denial-of-service (DoS) condition, making the affected application or service unresponsive to legitimate users.
Technical details
A vulnerability exists in the ASN.1 BER/DER parser of the Botan library due to inefficient algorithmic complexity (CWE-407). Specifically, certain patterns of indefinite length encodings in Basic Encoding Rules (BER) data trigger quadratic computational behavior during parsing. The library incorrectly accepted these indefinite length encodings even in structures where Distinguished Encoding Rules (DER) are required. An unauthenticated remote attacker can exploit this by providing malicious ASN.1 encoded data, such as a crafted X.509 certificate or OCSP response, to induce a CPU-based denial of service. The issue is resolved in Botan version 3.12.0.
Affected products
- randombit Botan < 3.12.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD