Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48057— Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn

Quick assessment

Affected
randombit botan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Botan 是一个 C++ 密码学库。在 3.13.0 版本之前，Botan 的 X.509 可区分名称（Distinguished Name, DN）解码器会将每个相对可区分名称（Relative Distinguished Name, RDN）中的属性 - 值断言（Attribute-Value Assertions）进行扁平化处理，从而在实施 DN 名称约束（name-constraint）之前丢失了多值 RDN 的分组信息。若攻击者控制了一个设置了名称约束的中间证书颁发机构（CA），则其可签发一份包含多值

CVSS 2.1 · Low

Possible ATT&CK Techniques 1 AI

T1603
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48057

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn
Source: CVE Program / CVE List V5
Vulnerability Description
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained intermediate CA can issue a certificate with a multi-value RDN whose first Common Name matches the permitted constraint and whose second Common Name is attacker-chosen, causing the constraint check to accept the flattened first value. If the certificate contains no subjectAlternativeName extension, the second Common Name can then be accepted as a hostname; Botan does not fall back to Common Name hostname matching when any subjectAlternativeName is present. The exposure is limited to deployments using DN name constraints, which are uncommon outside internal PKIs, and to certificates without a subjectAlternativeName. This issue is fixed in version 3.13.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
randombit botan < 3.13.0 -

II. Public POCs for CVE-2026-48057

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48057

请登录查看更多情报信息。

Other References for CVE-2026-48057 (3)

IV. Related Vulnerabilities

Same product: botan
Same vendor: randombit
Same weakness: CWE-295