CVE-2024-50382
published 2024-10-23CVE-2024-50382: Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM…
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.55%
42.1th percentile
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| botan_project | botan | < 3.6.0 | 3.6.0 |
| botan_project | botan | >= 0 < 2.19.3+dfsg-1+deb12u1 | 2.19.3+dfsg-1+deb12u1 |
| botan_project | botan | >= 0 < 2.19.5+dfsg-3 | 2.19.5+dfsg-3 |
| botan_project | botan | >= 0 < 2.19.1+dfsg-2ubuntu1+esm1 | 2.19.1+dfsg-2ubuntu1+esm1 |
| botan_project | botan | >= 0 < 2.19.3+dfsg-1ubuntu2+esm1 | 2.19.3+dfsg-1ubuntu2+esm1 |
| debian | botan | < botan 2.19.3+dfsg-1+deb12u1 (bookworm) | botan 2.19.3+dfsg-1+deb12u1 (bookworm) |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Botan vulnerabilities
vendor_ubuntu·2025-06-23·CVSS 5.3
CVE-2024-50382 [MEDIUM] Botan vulnerabilities
Title: Botan vulnerabilities
Summary: Several security issues were fixed in Botan.
It was discovered that Botan could have compiler dependent operations
induced under certain circumstances. An attacker could possibly use this
issue to cause undefined behavior. (CVE-2024-50382, CVE-2024-50383)
Bing Shi discovered that Botan did not limit the size of certain inputs
when checking primality and name constraints. An attacker could possibly
use this issue to cause a denial of service. (CVE-2024-34702,
CVE-2024-34703)
It was discovered that Botan did not correctly handle conflicting name
constraints. An attacker could possibly use this issue to bypass
authentication. (CVE-2024-39312)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-50382: botan - Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced se...
vendor_debian·2024·CVSS 5.9
CVE-2024-50382 [MEDIUM] CVE-2024-50382: botan - Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced se...
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
Scope: local
bookworm: resolved (fixed in 2.19.3+dfsg-1+deb12u1)
bullseye: open
trixie: resolved (fixed in 2.19.5+dfsg-3)
OSV
botan vulnerabilities
osv·2025-06-23·CVSS 5.3
CVE-2024-50382 [MEDIUM] botan vulnerabilities
botan vulnerabilities
It was discovered that Botan could have compiler dependent operations
induced under certain circumstances. An attacker could possibly use this
issue to cause undefined behavior. (CVE-2024-50382, CVE-2024-50383)
Bing Shi discovered that Botan did not limit the size of certain inputs
when checking primality and name constraints. An attacker could possibly
use this issue to cause a denial of service. (CVE-2024-34702,
CVE-2024-34703)
It was discovered that Botan did not correctly handle conflicting name
constraints. An attacker could possibly use this issue to bypass
authentication. (CVE-2024-39312)
OSV
CVE-2024-50382: Botan before 3
osv·2024-10-23·CVSS 5.9
CVE-2024-50382 [MEDIUM] CVE-2024-50382: Botan before 3
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
GHSA
GHSA-p27h-83pf-6hh9: Botan before 3
ghsa_unreviewed·2024-10-23
CVE-2024-50382 [MEDIUM] CWE-203 GHSA-p27h-83pf-6hh9: Botan before 3
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-32884 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-32884 [MEDIUM] CVE-2026-32884 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32884 :
Botan vulnerability analysis and mitigation
Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by the DNS name constraints, even though this check is technically not required by RFC 5280. However this check failed to account for the possibility of a mixed-case CN. Thus a certificate with CN=Sub.EVIL.COM and no subject alternative name would bypasses an excludedSubtrees constraint for evil.com because the comparison is case-sensitive. This issue has been patched in version 3.11.0.
Source : NVD
## 5.9
Score
Published March 30,
Wiz
CVE-2026-32877 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-32877 [MEDIUM] CVE-2026-32877 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32877 :
Botan vulnerability analysis and mitigation
Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C3) failed to check that the encoded value was of the expected length prior to comparison. An invalid ciphertext can cause a heap over-read of up to 31 bytes, resulting in a crash or potentially other undefined behavior. This issue has been patched in version 3.11.0.
Source : NVD
## 8.2
Score
Published March 30, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
Botan
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 16.7
Exploitation Probability (EPS
Wiz
CVE-2026-32883 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-32883 [MEDIUM] CVE-2026-32883 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32883 :
Botan vulnerability analysis and mitigation
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Botan
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
botan3
rust-sequoia-sq
Sources
NVD
Debian 13, 14 Severity MEDIUM No Fix Added at: Apr
2024-10-23
Published