CVE-2026-34582: Authentication Bypass in Botan 3.11.0

An attacker exploiting this vulnerability can bypass client certificate authentication, effectively impersonating legitimate clients. This could lead to unauthorized access to resources protected by the Botan library, potentially enabling data breaches, privilege escalation, or other malicious activities. The impact is particularly severe in systems relying on client certificates for strong authentication, such as secure web servers or VPN gateways. Successful exploitation could allow an attacker to establish a connection without proper verification, potentially gaining access to sensitive data or functionality.

1. Reserved2026-03-30
2. Published2026-04-07
3. Modified2026-04-08
4. EPSS updated2026-04-15

The primary mitigation is to upgrade to Botan version 3.11.1 or later, which contains the fix for this authentication bypass. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict TLS 1.3 configuration to enforce the proper sequence of messages. Review TLS 1.3 configurations to ensure the Finished message is received before processing ApplicationData records. Monitor network traffic for unusual patterns, such as application data records appearing before the Finished message, which could indicate an attempted exploitation.