DSA-6412-1 botan3 - security update
Multiple security issues were discovered in Botan, a C++ cryptography library, which could result in denial of service, certificate validation bypass or authentication bypass. These issues have been addressed by updating botan3 to the new upstream release 3.12.0. As a consequence this update changes the SONAME of the shared library, and the runtime library package is renamed from libbotan-3-7 to libbotan-3-12. No package in the stable distribution links against the library, so no other packages in trixie are affected by this change. The libbotan-3-7 package is no longer built and will not be removed automatically on upgrade if it had been installed manually. Locally built or third-party software linking against libbotan-3-7 needs to be rebuilt against libbotan-3-12, after which the old library package can be removed. https://security-tracker.debian.org/tracker/DSA-6412-1
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00323.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-443780.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-44378 | coverage & exploitation status | NVD · CVE.org |
More from Debian Security Advisories
- unknownDSA-6411-1 aom - security update2026-08-05
- unknownDSA-6410-1 libssh - security update2026-08-02
- unknownDSA-6409-1 libgd2 - security update2026-08-01
- unknownDSA-6406-1 php8.4 - security update2026-07-31
- unknownDSA-6407-1 incus - security update2026-07-31