CVE-2026-34580: 
Botan vulnerability analysis and mitigation

CVE-2026-34580 is a certificate authentication bypass vulnerability in the Botan C++ cryptography library, specifically introduced in version 3.11.0. The flaw stems from a logic error in the Certificate_Store::certificate_known function, which allowed an end entity certificate whose Distinguished Name (DN) and subject key identifier matched a trusted root to be accepted as a trusted root itself — without verifying the certificates were actually identical. Only Botan version 3.11.0 is affected; the issue was fixed in 3.11.1. It was disclosed on April 7, 2026, with a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-295 (Improper Certificate Validation). In Botan 3.11.0, the Certificate_Store::certificate_known function was designed to check whether a certificate matching a given DN (and optionally subject key identifier) existed in the trust store, but it did not verify that the matched certificate was byte-for-byte identical to the presented certificate. When path validation logic introduced in 3.11.0 called this function and assumed a true return meant the presented certificate was itself a trusted root, an attacker could craft or obtain an end entity certificate with a DN and subject key identifier matching any trusted root CA, and present it to bypass the entire certificate chain validation. The attack requires no privileges, no user interaction, and is exploitable over the network (GitHub Advisory).

Successful exploitation allows an attacker to completely bypass X.509 certificate verification in applications using Botan 3.11.0, enabling man-in-the-middle (MitM) attacks against TLS and other certificate-authenticated protocols. An attacker can impersonate any trusted entity — including certificate authorities — compromising both the confidentiality and integrity of encrypted communications and authentication mechanisms. Any system relying on Botan 3.11.0 for certificate validation (e.g., TLS clients/servers, mutual authentication systems) is at risk of accepting fraudulent certificates as fully trusted (GitHub Advisory, Feedly).

1. Reconnaissance: Identify target applications or services that use Botan 3.11.0 for certificate validation (e.g., TLS servers/clients, mutual TLS authentication endpoints).
2. Obtain trusted root DN: Inspect the target's trust store or use publicly available root CA certificates to extract the Distinguished Name (DN) and subject key identifier (SKID) of a trusted root CA certificate.
3. Craft a malicious end entity certificate: Generate a new end entity certificate (self-signed or otherwise) that uses the same DN and subject key identifier as the targeted trusted root CA, but with attacker-controlled key material.
4. Position for MitM: Place the attacker in a network position to intercept TLS or certificate-authenticated traffic between the victim and a legitimate server (e.g., via ARP spoofing, DNS hijacking, or rogue Wi-Fi).
5. Present the forged certificate: During the TLS handshake or certificate exchange, present the crafted end entity certificate to the vulnerable Botan 3.11.0 client or server.
6. Bypass validation: The vulnerable Certificate_Store::certificate_known function returns true because the DN and SKID match a trusted root, causing the path validation logic to accept the forged certificate as a trusted root — granting the attacker full impersonation of the trusted entity (GitHub Advisory).

• Network: Unexpected or anomalous TLS handshakes where the presented certificate chain terminates in an end entity certificate (leaf cert) rather than a recognized root CA; certificates with DNs matching known root CAs but with different public key fingerprints or serial numbers.
• Logs: TLS/application logs showing certificate validation success for certificates whose issuer chain is unusually short (e.g., a single self-signed cert matching a root CA DN); audit logs showing authentication successes from unexpected certificate subjects.
• File System: Presence of unusual certificate files (.pem, .crt, .der) with DNs matching trusted root CAs but different key material or serial numbers on systems that interact with Botan-based applications.
• Process/Application: Botan 3.11.0 linked in application binaries (detectable via ldd, strings, or package manager queries); Nessus plugin 305569 detection results indicating vulnerable Botan version (Feedly, Tenable).

The only fix is to upgrade Botan to version 3.11.1 or later, which corrects the Certificate_Store::certificate_known function to verify certificate identity rather than just DN/SKID matching (GitHub Advisory). No configuration-based workaround is available for Botan 3.11.0. Organizations should also audit any certificate validation events that occurred during the window when Botan 3.11.0 was in use, particularly for authentication or secure communication systems, to identify potential exploitation (Feedly).

The vulnerability was credited to Nicholas Carlini with Claude (Anthropic), drawing attention as a notable example of AI-assisted vulnerability discovery in a widely used cryptographic library (GitHub Advisory). A GitHub repository tracking Anthropic-credited CVEs (patrickmgarrity/Anthropic-Credited-CVEs) has logged this finding, reflecting community interest in AI-driven security research. German Linux security outlet Pro-Linux.de covered the issue as part of a broader Botan security advisory roundup (Pro-Linux). General community reaction has been moderate, consistent with a library-level cryptographic flaw affecting a specific version.