CVE-2024-34702

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.

• CWE-405

• https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e
• https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac
• https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
• https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf
• https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41
• https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
• https://github.com/randombit/botan/pull/4034
• https://github.com/randombit/botan/pull/4045
• https://github.com/randombit/botan/pull/4047
• https://github.com/randombit/botan/pull/4052
• https://github.com/randombit/botan/pull/4186
• https://github.com/randombit/botan/pull/4187
• https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j
• https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e
• https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac
• https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
• https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf
• https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41
• https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
• https://github.com/randombit/botan/pull/4034
• https://github.com/randombit/botan/pull/4045
• https://github.com/randombit/botan/pull/4047
• https://github.com/randombit/botan/pull/4052
• https://github.com/randombit/botan/pull/4186
• https://github.com/randombit/botan/pull/4187
• https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j

Published

Jul 8, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34696GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-34697FreeScout is a free, self-hosted help desk and shared mailbo…6.1
• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34701CreateWiki is Miraheze's MediaWiki extension for requesting …5.9
• CVE-2024-34703Botan is a C++ cryptography library. X.509 certificates can …7.5
• CVE-2024-34704era-compiler-solidity is the ZKsync compiler for Solidity. …5.9
• CVE-2024-34706Valtimo is an open source business process and case manageme…9.8
• CVE-2024-34707Nautobot is a Network Source of Truth and Network Automation…4.8
• CVE-2024-34708Directus is a real-time API and App dashboard for managing S…4.9
• CVE-2024-34709Directus is a real-time API and App dashboard for managing S…5.4