Loading story…
Botan disclosed CVE-2026-34580 / GHSA-v782-6fq4-q827, a certificate authentication bypass in Botan 3.11.0 that can cause X.509 verification to incorrectly trust an attacker-controlled end-entity certificate. The flaw stems from Certificate_Store::certificate_known, which returned true when a stored certificate merely matched the presented certificate’s distinguished name and, if present, subject key identifier, instead of confirming the two certificates were identical.
Because path validation logic introduced in Botan 3.11.0 treated that result as proof of certificate identity, an end-entity certificate could be accepted immediately as a trusted root if it reused the DN and optional subject key identifier of a legitimate trust anchor. Botan fixed the issue in version 3.11.1, and the advisory credits Nicholas Carlini with Claude, Anthropic for reporting the vulnerability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On April 7, 2026, Botan publicly disclosed the certificate authentication bypass vulnerability in advisory GHSA-v782-6fq4-q827 / CVE-2026-34580. The project fixed the issue in Botan 3.11.1.
The Botan advisory credits Nicholas Carlini with Claude, Anthropic for reporting the certificate authentication bypass issue affecting Botan 3.11.0.
Botan 3.11.0 included updated path validation logic that incorrectly treated Certificate_Store::certificate_known as proof of certificate identity. This created a condition where an end-entity certificate matching a trusted root's distinguished name and optional subject key identifier could be accepted as a trusted root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go disclosed **CVE-2026-33810**, a certificate validation flaw in `crypto/x509` in Go 1.26 that can cause excluded DNS name constraints to be enforced incorrectly for wildcard Subject Alternative Names. The bug appears when a wildcard SAN such as `*.example.com` is evaluated against an excluded constraint written with different letter casing, such as `EXAMPLE.COM`, allowing the wildcard domain to bypass the exclusion during certificate chain verification. The issue affects otherwise trusted certificate chains anchored in `VerifyOptions.Roots` or the system certificate pool, narrowing exposure to chains that already terminate at a trusted root CA. Go tracked the bug as issue **#78332**, credited the report to Riyas from Saintgits College of Engineering, k1rnt, and @1seal, and later published a fix on the `release-branch.go1.26`; downstream vendors including SUSE also opened advisories for the vulnerability.
Jun 29, 2026
A critical vulnerability (CVE-2025-12816) was discovered in the popular JavaScript cryptography library *node-forge*, which is downloaded over 20 million times per week. The flaw allows attackers to bypass signature verification by exploiting an interpretation-conflict in the library's ASN.1 validation mechanism, enabling malformed data to pass as valid even when cryptographically invalid. This vulnerability could allow unauthenticated attackers to craft ASN.1 structures that desynchronize schema validations, potentially bypassing cryptographic verifications and security decisions in applications relying on node-forge. The issue was responsibly disclosed by a researcher from Palo Alto Networks, and a fix was released in version 1.3.2 of node-forge. Security advisories from CERT-CC warn that the impact varies by application, but may include authentication bypass, signed data tampering, and misuse of certificate-related functions. Developers using node-forge are strongly advised to update to the latest version immediately to mitigate the risk, as the vulnerability could have significant consequences in environments where cryptographic verification is central to trust decisions.
Jun 29, 2026
CERT/CC disclosed **CVE-2026-9648** in the Haskell library `crypton-x509-validation`, warning that affected TLS clients may accept certificates that violate X.509 `NameConstraints`. The flaw stems from the library not enforcing the RFC 5280 safeguard, which can let an attacker who has compromised a name-constrained subordinate CA create certificates for domains outside the CA’s authorized scope and use them in malicious TLS interception. The vulnerability carries a **CVSS 9.1** rating and can expose organizations to credential theft, secret theft, and disclosure of sensitive financial data, particularly in delegated PKI environments such as banks, insurers, and large enterprises. **All prior versions are affected**, and the issue has been fixed in `crypton-x509-validation` **1.9.1**; maintainers and CERT/CC urged Haskell teams to upgrade immediately.
Jun 29, 2026