Input Handling Flaw in Botan Library by Randombit

CVE-2026-118767

What is CVE-2026-118767?

The Botan C++ cryptography library has a vulnerability in its Python bindings, where it improperly handles embedded NUL characters in strings. This flaw allows the bcrypt hashing function to process only the substring before the embedded NUL, permitting applications to validate longer passwords while hashing a truncated value. As a result, an attacker could exploit this weakness to bypass password policies. This issue has been addressed in version 3.13.0, but versions prior to this remain vulnerable.

References