CVE-2026-34580

OVERVIEW CVE-2026-34580 affects Botan, a C++ cryptography library, specifically version 3.11.0. The vulnerability stems from a flawed certificate validation function, Certificate_Store::certificate_known, which only checks if a certificate's Distinguished Name and subject key identifier match a trusted certificate in the store, rather than verifying the certificates are identical. This logic error allows an attacker to present an end entity certificate with matching DN and key identifier attributes as a trusted root certificate, causing it to be accepted as a trusted root without proper validation. The issue was introduced during an extension of path validation logic that incorrectly assumed the certificate_known function performed full certificate matching. The vulnerability is resolved in version 3.11.1. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no privileges or user interaction. The attack complexity is low, meaning exploitation can be performed reliably by an attacker with network access. The primary impact is integrity compromise, as an attacker could forge or manipulate certificate validation chains, while confidentiality and availability remain unaffected. The EPSS score of 0.00022 indicates this vulnerability has very low prevalence in public exploit datasets. EXPLOITATION STATUS There is currently no evidence of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has emerged. Community attention remains minimal given the specialized nature of the Botan library and the vulnerability's recent discovery. Organizations using Botan 3.11.0 should prioritize upgrading to 3.11.1 to mitigate this trust validation bypass.