CVE-2024-34703

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.

• CWE-405
• CWE-770

• https://github.com/randombit/botan/commit/08c404b23740babee1f6aa51b54e966029aadee4
• https://github.com/randombit/botan/commit/94e9154c143aa5264da6254a6a1be5bc66ee2b5a
• https://github.com/randombit/botan/security/advisories/GHSA-w4g2-7m2h-7xj7
• https://github.com/randombit/botan/commit/08c404b23740babee1f6aa51b54e966029aadee4
• https://github.com/randombit/botan/commit/94e9154c143aa5264da6254a6a1be5bc66ee2b5a
• https://github.com/randombit/botan/security/advisories/GHSA-w4g2-7m2h-7xj7

Published

Jun 30, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34697FreeScout is a free, self-hosted help desk and shared mailbo…6.1
• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34701CreateWiki is Miraheze's MediaWiki extension for requesting …5.9
• CVE-2024-34702Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-34704era-compiler-solidity is the ZKsync compiler for Solidity. …5.9
• CVE-2024-34706Valtimo is an open source business process and case manageme…9.8
• CVE-2024-34707Nautobot is a Network Source of Truth and Network Automation…4.8
• CVE-2024-34708Directus is a real-time API and App dashboard for managing S…4.9
• CVE-2024-34709Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2024-3471The Button Generator WordPress plugin before 3.0 does not h…3.4