Read the docs
TI-2026-82698 Aliases CVE-2026-118767

Botan Python binding bcrypt APIs truncate passwords at embedded NULs

Priority LOW 21CWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Botan from 1.11.22 before 3.13.0 has a flaw in its Python binding, which does not consistently reject strings with embedded NUL characters (CWE-158). The bcrypt and check_bcrypt functions process only the prefix before the NUL, so an application can validate a longer password but hash a shorter one. A remote attacker with no privileges and no user interaction can bypass application password policies, though the attack complexity is high. The scrypt and argon2 functions are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Fixed botan (randombit): 3.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
randombitbotan1.11.22 to before 3.13.03.13.0Patch availableCNA
  • botan Vendorrandombit Affected 1.11.22 to before 3.13.0 Fixed in 3.13.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*——randombit
  • cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:* Versions — — ·randombit

Remediation

Update Botan to version 3.13.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA botan (randombit) Fixed in 3.13.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-118767
  2. 2026-10-30 Affected versions changed · Red Hat
  3. 2026-10-30 CVSS score added · Red Hat
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-07 Affected versions changed · Red Hat

References

Other 3

  • TI-2024-33818 Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced… CVSS 3.1MEDIUM 5.9
  • TI-2024-33817 Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced… CVSS 3.1MEDIUM 5.9
  • TI-2016-02004 Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before… CVSS 3.0CRITICAL 9.8
  • TI-2016-02005 Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27… CVSS 3.0CRITICAL 9.8
  • TI-2026-26828 Botan has a certificate authentication bypass due to trust anchor confusion CVSS 4.0CRITICAL 9.3
  • TI-2016-07479 In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur… CVSS 3.0CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences