Botan CVE-2026-32884

The CVSS v3.1 score of 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N indicates a network-accessible vulnerability requiring high attack complexity, unauthenticated access, no user interaction, with integrity impact but no confidentiality or availability impact. The high attack complexity likely reflects the requirement to craft a malicious certificate and present it during a TLS handshake to a system enforcing name constraints. The integrity impact is significant: successful exploitation allows an attacker to establish a secure connection to a domain that should have been restricted by name constraints, potentially enabling man-in-the-middle attacks or unauthorized certificate issuance for restricted domains. The moderate CVSS score combined with the requirement for system-level certificate validation policies (name constraints are typically configured by PKI administrators rather than individual users) suggests this is primarily a risk to organizations implementing strict certificate policies. The impact is meaningful for certificate validation infrastructure and systems that rely on name constraints to enforce domain ownership boundaries, but the practical attack surface depends on whether the target system has name constraints configured. No public exploit code or active exploitation is indicated in the provided data.

An attacker obtains or constructs an X.509 certificate with a Common Name containing mixed-case characters (e.g., CN=Sub.EVIL.COM) and no Subject Alternative Name extension, targeting a domain restricted by an excludedSubtrees name constraint (e.g., evil.com). When a system using vulnerable Botan validates this certificate during a TLS connection, the case-sensitive CN comparison fails to detect the constraint violation, allowing the certificate to be incorrectly validated. The attacker can then use this certificate to establish a secure connection impersonating the restricted domain, potentially intercepting or misdirecting traffic. The requirement for high attack complexity suggests the attacker must either control the TLS server presenting the malicious certificate or exploit it in a specific validation context where name constraints are enforced.