How severe is CVE-2026-44378?

CVE-2026-44378 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-44378 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-44378?

CVE-2026-44378 affects Botan Project Botan. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-44378?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-44378 have an EU (EUVD) identifier?

Yes. CVE-2026-44378 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32582.

When was CVE-2026-44378 published?

CVE-2026-44378 was published on 2026-05-27 and last updated on 2026-06-17.

CVE-2026-44378

CVE-2026-44378 is a high-severity vulnerability in Botan Project Botan with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-407.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 6.9
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-32582
Weakness: CWE-407
Affected product: Botan Project Botan
Published: 2026-05-27
Last modified: 2026-06-17

Description

Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.

Frequently asked questions

What is CVE-2026-44378?: Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings. This vulnerability is fixed in 3.12.0.
How severe is CVE-2026-44378?: CVE-2026-44378 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-44378 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-44378?: CVE-2026-44378 affects Botan Project Botan. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-44378?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-44378 have an EU (EUVD) identifier?: Yes. CVE-2026-44378 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32582.
When was CVE-2026-44378 published?: CVE-2026-44378 was published on 2026-05-27 and last updated on 2026-06-17.

References

https://github.com/randombit/botan/security/advisories/GHSA-7q2v-3g27-6g3j

Affected products (1)

cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*

More vulnerabilities in Botan Project Botan

CVE-2021-24115 — Critical (CVSS 9.8): In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32,…
CVE-2018-9127 — Critical (CVSS 9.8): Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as…
CVE-2016-6878 — Critical (CVSS 9.8): The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to…
CVE-2015-7826 — Critical (CVSS 9.8): botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers…
CVE-2016-9132 — Critical (CVSS 9.8): In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect…
CVE-2016-2196 — Critical (CVSS 9.8): Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to…

All CVEs affecting Botan Project Botan →

Other CWE-407 vulnerabilities

CVE-2026-58226 — High (CVSS 8.7): Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via…
CVE-2026-54892 — High (CVSS 8.7): Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to…
CVE-2026-59094 — High (CVSS 7.5): Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed…
CVE-2026-53433 — High (CVSS 7.5): fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to…
CVE-2026-13311 — High (CVSS 7.5): shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator,…
CVE-2026-48516 — High (CVSS 7.5): MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7,…

Browse all CWE-407 vulnerabilities →