CVE-2026-34582

VULNERABILITY OVERVIEW CVE-2026-34582 affects Botan, a widely-used C++ cryptography library, in versions prior to 3.11.1. The vulnerability exists in the TLS 1.3 implementation, which incorrectly processes ApplicationData records before validating the Finished message. This flaw allows unauthenticated clients to bypass client certificate authentication by omitting required handshake messages (Certificate, CertificateVerify, and Finished) and sending application data directly. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 9.1 (CRITICAL) with a network-based attack vector, low attack complexity, and no privileges or user interaction required. The impact is severe, with high confidentiality and integrity compromise possible. An attacker can completely circumvent certificate-based client authentication mechanisms on affected TLS 1.3 servers, potentially gaining unauthorized access to protected resources or services. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild, as indicated by the absence of this CVE from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on the Hot List. However, organizations running Botan versions prior to 3.11.1 should prioritize patching immediately given the critical severity and the straightforward nature of the authentication bypass attack. The EPSS score of 0.00029 suggests low current exploitation probability, but this should not diminish the urgency of remediation due to the vulnerability's fundamental impact on authentication security.