CVE-2026-48057 · Package
NO FIX YET · SEE WHAT TO DO
Botan is a C++ cryptography library whose X.509 distinguished name decoder loses multi-value RDN grouping before name-constraint checks. An attacker holding a name-constrained intermediate CA can issue a certificate whose second Common Name is accepted as a hostname, provided the certificate has no subjectAlternativeName.
first public Sep 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments that use X.509 distinguished name name constraints, which are uncommon outside internal PKIs, and that accept certificates lacking a subjectAlternativeName extension are exposed. Applications that use Botan for TLS against public certificates with SANs are unlikely to be affected. Teams that do not validate DN name constraints can skip it.
Not affected if no-dn-name-constraints, public-web-pki, subjectaltname-present
Who cares botan, c++, internal-pki, x.509
botan version or the library's version header3.13.0Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained intermediate CA can issue a certificate with a multi-value RDN whose first Common Name matches the permitted constraint and whose second Common Name is attacker-chosen, causing the constraint check to accept the flattened first value. If the certificate contains no subjectAlternativeName extension, the second Common Name can then be accepted as a hostname; Botan does not fall back to Common Name hostname matching when any subjectAlternativeName is present. The exposure is limited to deployments using DN name constraints, which are uncommon outside internal PKIs, and to certificates without a subjectAlternativeName. This issue is fixed in version 3.13.0.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.