Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118767— Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs

Quick assessment

Affected
randombit botan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Botan 是一个 C++ 加密库。在版本 1.11.22 至 3.13.0 期间，Botan 的 Python 绑定在将包含 U+0000（空字符）的 Python 字符串转换为 时，未能一致地拒绝该嵌入的空字符，导致 和 函数仅处理空字符之前的前缀。这使得应用程序可能验证较长的密码，却仅对较短的有效值进行哈希计算，从而绕过应用程序的密码策略。 和 不受此问题影响。该问题已在版本 3.13.0 中修复。

CVSS 4.8 · Medium

Possible ATT&CK Techniques 1 AI

T1110 · Brute Force

Affected Version Matrix 1

VendorProduct Version RangeStatus
randombit botan >= 1.11.22, < 3.13.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118767

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs
Source: CVE Program / CVE List V5
Vulnerability Description
Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
空字节或NULL字符转义处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
randombit botan >= 1.11.22, < 3.13.0 -

II. Public POCs for CVE-2026-118767

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118767

请登录查看更多情报信息。

Other References for CVE-2026-118767 (3)

Same Patch Batch · randombit · 2026-10-29 · 5 CVEs total

CVE-2026-118769 9.2 CRITICAL Botan: Integer overflow when reporting block size in FFI can cause memory corruption
CVE-2026-118765 7.3 HIGH Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state
CVE-2026-118766 6.1 MEDIUM Botan: Online OCSP redirects enable blind requests to internal HTTP services
CVE-2026-118768 5.9 MEDIUM Botan: CLI utility `ocsp_check` accepts unauthenticated responses

IV. Related Vulnerabilities

Same product: botan
Same vendor: randombit
Same weakness: CWE-158