CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)

• CWE-203

• https://arxiv.org/pdf/2410.13489Exploit, Technical Description, Third Party Advisory
• https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957Patch
• https://github.com/randombit/botan/compare/3.5.0...3.6.0Product
• https://news.ycombinator.com/item?id=41887153Issue Tracking

Published

Oct 23, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50378Airflow versions before 2.10.3 have a vulnerability that all…4.9
• CVE-2024-50379Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabil…9.8
• CVE-2024-5038The Colibri Page Builder plugin for WordPress is vulnerable …5.4
• CVE-2024-50380Snap One OVRC cloud uses the MAC address as an identifier to…8.7
• CVE-2024-50381A vulnerability exists in Snap One OVRC cloud where an attac…8.8
• CVE-2024-50382Botan before 3.6.0, when certain LLVM versions are used, has…5.9
• CVE-2024-50384A denial of service vulnerability exists in the NetX Compone…7.5
• CVE-2024-50385A denial of service vulnerability exists in the NetX Compone…7.5
• CVE-2024-50386Account users in Apache CloudStack by default are allowed to…9.9
• CVE-2024-50387A SQL injection vulnerability has been reported to affect se…9.8
• CVE-2024-50388An OS command injection vulnerability has been reported to a…9.8
• CVE-2024-50389A SQL injection vulnerability has been reported to affect Qu…9.8