Skip to content
Sign in
7.5 High

CVE-2024-34703 Botan is a C++ cryptography library

Description

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.

Affected products and versions

Product Affected versions Fixed in
Botan 3.0 3.0.0-alpha0 → < 3.3.0 3.3.0
Botan 2.19 earliest → < 2.19.4 2.19.4

Other CVEs of Botan

The 17 CVEs of Botan →
CVE-2026-104267 Botan: scrypt V-buffer heap overflow on 32-bit from constructor-accepted parameters 4.1 Medium CVE-2026-48057 Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn 2.1 Low CVE-2026-118769 Botan is a C++ cryptography library 9.2 Critical CVE-2026-118768 Botan is a C++ cryptography library 5.9 Medium
Track this CVE