CVE-2026-34582: 
Botan vulnerability analysis and mitigation

CVE-2026-34582 is a TLS 1.3 authentication bypass vulnerability in the Botan C++ cryptography library, classified as Critical. Prior to version 3.11.1, Botan's TLS 1.3 implementation allowed ApplicationData records to be processed before the Finished message was received, enabling a client to completely bypass certificate-based mutual authentication. Affected versions span Botan 3.0.0 through 3.11.0; version 3.11.1 contains the fix. It was published on April 7, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-841 (Improper Enforcement of Behavioral Workflow): Botan's TLS 1.3 state machine failed to enforce the required ordering of handshake messages before permitting application data processing. In a standard TLS 1.3 mutual authentication flow, the client must send Certificate, CertificateVerify, and Finished messages before any ApplicationData is exchanged. A malicious client can exploit this flaw by skipping all three of those messages entirely and sending ApplicationData records directly, which the server incorrectly processes without validating that authentication was completed. No special privileges, user interaction, or complex conditions are required — the attack is network-accessible with low complexity (GitHub Advisory). The vulnerability was reported by Ben Smyth (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass mutual TLS (mTLS) client certificate authentication on any server using Botan 3.0.0–3.11.0 with TLS 1.3 and certificate-based client authentication enforced. The attacker gains unauthorized access to resources and data that should be protected behind certificate authentication, resulting in high confidentiality and integrity impact. Availability is not directly affected, but unauthorized access to protected services could enable lateral movement, data exfiltration, or abuse of privileged application functionality (GitHub Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.028% (0.000280), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and is remotely exploitable over the network, making it straightforward to weaponize if targeted (GitHub Advisory).

1. Reconnaissance: Identify servers using Botan versions 3.0.0–3.11.0 for TLS 1.3 connections that enforce client certificate authentication (mTLS). This can be done via network scanning, banner grabbing, or reviewing open-source project dependencies.
2. Initiate TLS 1.3 handshake: Connect to the target server and begin a standard TLS 1.3 handshake. The server will send its Certificate, CertificateVerify, and Finished messages as expected.
3. Skip client authentication messages: Instead of responding with the required Certificate, CertificateVerify, and Finished messages, omit them entirely from the client-side handshake flow.
4. Send ApplicationData directly: Immediately send ApplicationData records to the server. Due to the state machine flaw, the vulnerable Botan server processes these records without verifying that the client completed authentication.
5. Access protected resources: The server treats the connection as authenticated, granting the attacker access to application data and protected resources that require valid client certificates (GitHub Advisory).

• Network: TLS 1.3 sessions where the client sends ApplicationData records without a preceding Certificate, CertificateVerify, or Finished message in the handshake; connections from clients that do not present any certificate during mTLS negotiation yet successfully establish a session.
• Logs: Server-side TLS/application logs showing authenticated sessions from clients with no associated certificate subject or serial number; absence of certificate validation log entries for sessions that should require mTLS.
• Application Behavior: Requests reaching application endpoints that are supposed to be restricted to certificate-authenticated clients, originating from connections with no client certificate metadata attached.

The primary remediation is to upgrade Botan to version 3.11.1 or later, which correctly enforces TLS 1.3 handshake message ordering (GitHub Advisory). If immediate upgrade is not possible, the following workarounds are available:

• Disable TLS 1.3: Fall back to TLS 1.2, which correctly enforces the ordering of application vs. handshake messages.
• Check peer certificate chain: Verify the return value of Channel::peer_cert_chain() after the handshake to confirm a certificate was presented.
• Override callback: Implement TLS::Callbacks::tls_inspect_handshake_msg in your application to explicitly verify that a Finished message was received before processing application data.

OpenSUSE and other Linux distributions have also issued security updates packaging the fixed version (openSUSE Security).

The vulnerability was reported by security researcher Ben Smyth and disclosed via GitHub's security advisory system (GitHub Advisory). Downstream Linux distributions including openSUSE issued security announcements and package updates shortly after disclosure (openSUSE Security). Tenable added detection via Nessus plugin 305256, and the vulnerability was indexed by ENISA's European Vulnerability Database (EUVD-2026-19948). No significant social media controversy or broad media coverage has been observed beyond standard vulnerability tracking outlets.