Is CVE-2026-48057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48057 being exploited in the wild.

How severe is CVE-2026-48057?

Informational severity, published 6 November 2026.

Is there a fix for CVE-2026-48057?

Yes: fixed in 3.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48057 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48057?

Check whether you run Botan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48057: Botan X.509 Distinguished Name constraint bypass via multi-value RDN

CVE-2026-48057 · Severity: info · Published 2026-11-06

Botan is a C++ cryptography library used in applications that validate digital certificates. A flaw in how Botan processes certificate Distinguished Names allows an attacker with control of a name-constrained intermediate CA to issue certificates that bypass name constraints and hostname validation, potentially enabling man-in-the-middle attacks. This vulnerability affects a narrow set of deployments using the uncommon DN name-constraint feature and only impacts certificates lacking a subjectAlternativeName extension.

Technologies: Botan. Vendors: Botan.

Quick answers

Is CVE-2026-48057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48057 being exploited in the wild.
How severe is CVE-2026-48057?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Botan prior to 3.13.0.
Is there a fix for CVE-2026-48057?: Yes: fixed in 3.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48057 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48057?: Check whether you run Botan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.13.0

Technical details

The X.509 Distinguished Name decoder in Botan prior to 3.13.0 flattens multi-value Relative Distinguished Names (RDNs), losing the internal grouping structure before name-constraint validation. An attacker controlling a name-constrained intermediate CA can craft a certificate with a multi-value RDN where the first CN matches the permitted constraint; the constraint check operates on the flattened structure and accepts only the first value, but the second CN can then be used for hostname matching when no subjectAlternativeName is present. The fix preserves RDN grouping during decoding and updates constraint matching to use set-equality comparison within each RDN per RFC 5280.

Affected products

Botan Botan prior to 3.13.0

Timeline

2026-11-06: disclosed
2026-05-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.