C++ Cryptography Library Botan Vulnerability in X.509 Name-Value Decoding

CVE-2026-48057

What is CVE-2026-48057?

Prior to version 3.13.0, Botan's X.509 Distinguished Name decoder inadequately handled Attribute-Value Assertions in Relative Distinguished Names (RDN), leading to potential exploitation by attackers controlling a name-constrained intermediate CA. The flawed implementation could allow the issuance of a certificate containing a multi-value RDN wherein an attacker could dictate the second Common Name. If not supplemented by a subjectAlternativeName extension, this could lead to acceptance of the attacker's chosen hostname, circumventing established name constraints. This vulnerability is primarily an issue for those utilizing DN name constraints in their deployment and is now resolved in version 3.13.0.

References