CVE-2026-44378
Multiple security issues were discovered in Botan, a C++ cryptography library, which could result in denial of service, certificate validation bypass or authentication bypass. These issues have been addressed by updating botan3 to the new upstream release 3.12.0. As a consequence this update changes the SONAME of the shared library, and the runtime library package is renamed from libbotan-3-7 to libbotan-3-12. No package in the stable distribution links against the library, so no other packages in trixie are affected by this change. The libbotan-3-7 package is no longer built and will not be removed automatically on upgrade if it had been installed manually. Locally built or third-party software linking against libbotan-3-7 needs to be rebuilt against libbotan-3-12, after which the old library package can be removed. https://security-tracker.debian.org/tracker/DSA-6412-1
⚡ Watch CVE-2026-44378
Get an email if CVE-2026-44378 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Advisory coverage (1)
- unknownDSA-6412-1 botan3 - security updatedebian · 2026-08-05
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-44378)