CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

DSA-6412-1 botan3 - security update

unknownCVE-2026-44378
Multiple security issues were discovered in Botan, a C++ cryptography library, which could result in denial of service, certificate validation bypass or authentication bypass. These issues have been addressed by updating botan3 to the new upstream release 3.12.0. As a consequence this update changes the SONAME of the shared library, and the runtime library package is renamed from libbotan-3-7 to libbotan-3-12. No package in the stable distribution links against the library, so no other packages in trixie are affected by this change. The libbotan-3-7 package is no longer built and will not be removed automatically on upgrade if it had been installed manually. Locally built or third-party software linking against libbotan-3-7 needs to be rebuilt against libbotan-3-12, after which the old library package can be removed. https://security-tracker.debian.org/tracker/DSA-6412-1

Details

Source
Debian Security Advisories (INTL · vendor-psirt · site)
Severity
unknown
Published
2026-08-05
Exploitation
Not in CISA KEV at last sync

Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00323.html

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-44378coverage & exploitation statusNVD · CVE.org

More from Debian Security Advisories