CVE-2026-34582

Publication date 7 April 2026

Last updated 8 April 2026


Ubuntu priority

Description

Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.

Status

Package Ubuntu Release Status
botan 25.10 questing
Needs evaluation
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
botan3 25.10 questing
Needs evaluation
24.04 LTS noble Not in release
22.04 LTS jammy Not in release


Access our resources on patching vulnerabilities