CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack.

• CWE-200

• http://www.securityfocus.com/bid/94225Third Party Advisory, VDB Entry
• https://botan.randombit.net/security.htmlVendor Advisory
• http://www.securityfocus.com/bid/94225Third Party Advisory, VDB Entry
• https://botan.randombit.net/security.htmlVendor Advisory

Published

Oct 28, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8863Heap-based buffer overflow in the create_url_list function i…
• CVE-2016-8864named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-…7.5
• CVE-2016-8866The AcquireMagickMemory function in MagickCore/memory.c in I…8.8
• CVE-2016-8867Docker Engine 1.12.2 enabled ambient capabilities with misco…
• CVE-2016-8869The register method in the UsersModelRegistration class in c…
• CVE-2016-8870The register method in the UsersModelRegistration class in c…
• CVE-2016-8875The ConvertToPDF plugin in Foxit Reader and PhantomPDF befor…
• CVE-2016-8876Out-of-Bounds read vulnerability in Foxit Reader and Phantom…
• CVE-2016-8877Heap buffer overflow (Out-of-Bounds write) vulnerability in …
• CVE-2016-8878Out-of-Bounds read vulnerability in Foxit Reader and Phantom…
• CVE-2016-8879The thumbnail shell extension plugin (FoxitThumbnailHndlr_x8…
• CVE-2016-8880Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…