CVE-2026-44378 Botan: Quadratic complexity decoding BER indefinite length encodings

What is CVE-2026-44378?

CVE-2026-44378 is a medium-severity denial of service vulnerability in randombit botan, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.

Weakness: CWE-407

Which versions are affected by CVE-2026-44378?

It affects 1 product.

Products include Botan Project Botan.

How do I fix CVE-2026-44378?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-44378 being exploited?

There is no known exploitation of CVE-2026-44378 in the wild and no public exploit code.

Other vulnerabilities in randombit botan

• CVE-2021-24115 Information disclosure in n/a Critical 9.8
• CVE-2018-9127 Security feature bypass in n/a Critical 9.8
• CVE-2015-7826 Security feature bypass in n/a Critical 9.8
• CVE-2016-6878 Other in n/a Critical 9.8
• CVE-2016-9132 Integer overflow in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-88802, DEBIAN-CVE-2026-44378, GHSA-7q2v-3g27-6g3j, OESA-2026-4213, UBUNTU-CVE-2026-44378, openSUSE-SU-2026:11649-1.