Denial of Service in Botan C++ Cryptography Library

CVE-2026-44378

What is CVE-2026-44378?

The Botan C++ cryptography library is susceptible to a vulnerability that allows for potential denial of service. Specifically, prior to version 3.12.0, the library's parser could exhibit quadratic behavior when processing certain patterns of indefinite length encodings in BER data. Such encodings were improperly accepted in scenarios where DER encoding is mandated, which prohibits indefinite length encodings. This flaw can lead to excessive resource consumption and unresponsiveness, risking the availability of services that rely on Botan for cryptographic operations. The issue has been addressed in version 3.12.0.

References