CVE-2026-34582

Name	CVE-2026-34582
Description	Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
botan (PTS)	bullseye	2.17.3+dfsg-2	vulnerable
	bookworm	2.19.3+dfsg-1+deb12u1	vulnerable
	trixie	2.19.5+dfsg-4	vulnerable
botan3 (PTS)	trixie	3.7.1+dfsg-2	vulnerable
	forky, sid	3.10.0+dfsg-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
botan	source	(unstable)	(unfixed)
botan3	source	experimental	3.11.0+dfsg-1
botan3	source	(unstable)	(unfixed)

https://github.com/randombit/botan/security/advisories/GHSA-pxcj-9ppx-g86g
https://github.com/randombit/botan/pull/5599