CVE-2026-32884: 
Botan vulnerability analysis and mitigation

CVE-2026-32884 is a case-sensitive DNS name constraint bypass vulnerability in the Botan C++ cryptography library affecting all versions prior to 3.11.0 (≤ 3.10.0). During X.509 certificate path validation, Botan's handling of DNS excludedSubtrees name constraints fails to perform case-insensitive comparisons when checking the Common Name (CN) of end-entity certificates lacking a Subject Alternative Name (SAN). This allows a certificate with a mixed-case CN (e.g., CN=Sub.EVIL.COM) to bypass a constraint intended to exclude evil.com. The vulnerability was published on March 30, 2026, and patched in version 3.11.0. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation) and CWE-178 (Improper Handling of Case Sensitivity). Per RFC 5280, DNS name comparisons must be case-insensitive; however, Botan's implementation performs a case-sensitive string comparison when validating a certificate's CN against excludedSubtrees DNS name constraints. This check is only triggered when the end-entity certificate has no SAN — a scenario Botan handles as a fallback — making the bypass conditional on the absence of a SAN field. An attacker in possession of a certificate with a mixed-case CN (e.g., issued by a misconfigured or compromised sub-CA) can exploit this flaw to have the excluded domain constraint silently ignored by any application using Botan for certificate path validation (GitHub Advisory).

Successful exploitation allows an attacker to present a certificate for a domain that should be excluded by name constraints, effectively bypassing PKI-enforced domain restrictions. This enables man-in-the-middle (MITM) attacks or unauthorized certificate acceptance for restricted domains, with a high integrity impact and no confidentiality or availability impact. The vulnerability is most relevant in enterprise and government PKI environments that rely on nameConstraints to limit CA issuance scope, such as US FPKI, EU eIDAS, and CAB Forum BR Section 7.1.5 technically constrained sub-CAs (GitHub Advisory).

1. Obtain a qualifying certificate: Acquire or generate an end-entity certificate with a mixed-case CN (e.g., CN=Sub.EVIL.COM) and no Subject Alternative Name (SAN) extension, issued by a sub-CA whose scope is constrained to exclude evil.com.
2. Identify a vulnerable target: Locate an application or service that uses Botan versions ≤ 3.10.0 for X.509 certificate path validation and enforces DNS excludedSubtrees name constraints.
3. Present the certificate: Initiate a TLS or other PKI-authenticated connection to the target, presenting the crafted certificate during the handshake.
4. Bypass name constraint enforcement: Because Botan performs a case-sensitive comparison, Sub.EVIL.COM does not match the excluded subtree evil.com, and the constraint check passes incorrectly.
5. Achieve MITM or impersonation: With the certificate accepted, the attacker can impersonate a legitimate service within the restricted domain, enabling interception or manipulation of communications (GitHub Advisory).

• Network: TLS connections presenting certificates with mixed-case CN values (e.g., Sub.EVIL.COM) where the domain should be excluded by name constraints; unexpected certificate chains from sub-CAs in enterprise PKI environments.
• Logs: Certificate validation logs showing acceptance of certificates with CNs that differ only in case from entries in excludedSubtrees constraints; absence of SAN fields in accepted end-entity certificates in TLS inspection or audit logs.
• File System: Presence of certificate files (.pem, .crt, .cer) with mixed-case CN values and no SAN extension in application trust stores or temporary directories.

The primary remediation is to upgrade Botan to version 3.11.0 or later, which corrects the CN comparison to be case-insensitive (GitHub Advisory). For organizations unable to upgrade immediately, the following interim measures are recommended:

1. Implement application-level, case-insensitive validation of certificate CN values against DNS name constraints as a compensating control.
2. Audit X.509 certificate chains in use, particularly end-entity certificates lacking SANs, to identify any that could exploit this bypass.
3. Monitor PKI infrastructure for certificates issued with mixed-case CNs in constrained sub-CA environments.

The vulnerability was reported by researcher HarutoKimura and disclosed via GitHub Security Advisories on March 29, 2026. Coverage has been noted in Linux security news outlets (e.g., Pro-Linux.de) and community forums such as the Solus Project weekly update, indicating awareness in open-source and Linux distribution communities. No major vendor statements or widespread social media discussion beyond routine CVE tracking have been observed (GitHub Advisory).