Lookup for vulnerable packages by Package URL.
| Purl | pkg:deb/debian/botan3@3.10.0%2Bdfsg-2?distro=trixie |
| Type | deb |
| Namespace | debian |
| Name | botan3 |
| Version | 3.10.0+dfsg-2 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 3.11.0+dfsg-2 |
| Latest_non_vulnerable_version | 3.11.1+dfsg-2 |
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-53zr-h1xh-w3fg |
| vulnerability_id |
VCID-53zr-h1xh-w3fg |
| summary |
Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by the DNS name constraints, even though this check is technically not required by RFC 5280. However this check failed to account for the possibility of a mixed-case CN. Thus a certificate with CN=Sub.EVIL.COM and no subject alternative name would bypasses an excludedSubtrees constraint for evil.com because the comparison is case-sensitive. This issue has been patched in version 3.11.0. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-32884 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03627 |
| published_at |
2026-04-04T12:55:00Z |
|
| 1 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03612 |
| published_at |
2026-04-02T12:55:00Z |
|
| 2 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.05673 |
| published_at |
2026-04-08T12:55:00Z |
|
| 3 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.057 |
| published_at |
2026-04-09T12:55:00Z |
|
| 4 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.05671 |
| published_at |
2026-04-12T12:55:00Z |
|
| 5 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.05679 |
| published_at |
2026-04-11T12:55:00Z |
|
| 6 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.05665 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.05636 |
| published_at |
2026-04-07T12:55:00Z |
|
| 8 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.05951 |
| published_at |
2026-04-18T12:55:00Z |
|
| 9 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.0594 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-32884 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-32884
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-53zr-h1xh-w3fg |
|
| 1 |
| url |
VCID-8xnb-g7pw-y3cn |
| vulnerability_id |
VCID-8xnb-g7pw-y3cn |
| summary |
|
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-34582 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.08135 |
| published_at |
2026-04-09T12:55:00Z |
|
| 1 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.08113 |
| published_at |
2026-04-08T12:55:00Z |
|
| 2 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.08107 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.08126 |
| published_at |
2026-04-11T12:55:00Z |
|
| 4 |
| value |
0.00029 |
| scoring_system |
epss |
| scoring_elements |
0.08053 |
| published_at |
2026-04-18T12:55:00Z |
|
| 5 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09891 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09774 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-34582 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-34582
|
| risk_score |
4.1 |
| exploitability |
0.5 |
| weighted_severity |
8.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8xnb-g7pw-y3cn |
|
| 2 |
| url |
VCID-gw14-fx4m-qqag |
| vulnerability_id |
VCID-gw14-fx4m-qqag |
| summary |
Botan: Botan: Compromised certificate validation integrity via unverified OCSP response signatures |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-32883 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03613 |
| published_at |
2026-04-08T12:55:00Z |
|
| 1 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03612 |
| published_at |
2026-04-07T12:55:00Z |
|
| 2 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03635 |
| published_at |
2026-04-09T12:55:00Z |
|
| 3 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03593 |
| published_at |
2026-04-11T12:55:00Z |
|
| 4 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03564 |
| published_at |
2026-04-12T12:55:00Z |
|
| 5 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03539 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.03977 |
| published_at |
2026-04-16T12:55:00Z |
|
| 7 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.03989 |
| published_at |
2026-04-18T12:55:00Z |
|
| 8 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05348 |
| published_at |
2026-04-04T12:55:00Z |
|
| 9 |
| value |
0.0002 |
| scoring_system |
epss |
| scoring_elements |
0.05317 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-32883 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-32883
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gw14-fx4m-qqag |
|
| 3 |
| url |
VCID-kyg3-jbf1-qyb1 |
| vulnerability_id |
VCID-kyg3-jbf1-qyb1 |
| summary |
Botan: Botan: Denial of Service via heap over-read during SM2 decryption |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-32877 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00045 |
| scoring_system |
epss |
| scoring_elements |
0.13908 |
| published_at |
2026-04-04T12:55:00Z |
|
| 1 |
| value |
0.00045 |
| scoring_system |
epss |
| scoring_elements |
0.13851 |
| published_at |
2026-04-02T12:55:00Z |
|
| 2 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16837 |
| published_at |
2026-04-08T12:55:00Z |
|
| 3 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16894 |
| published_at |
2026-04-09T12:55:00Z |
|
| 4 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.1687 |
| published_at |
2026-04-11T12:55:00Z |
|
| 5 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16825 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16766 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16749 |
| published_at |
2026-04-07T12:55:00Z |
|
| 8 |
| value |
0.00056 |
| scoring_system |
epss |
| scoring_elements |
0.17648 |
| published_at |
2026-04-18T12:55:00Z |
|
| 9 |
| value |
0.00056 |
| scoring_system |
epss |
| scoring_elements |
0.17639 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-32877 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-32877
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kyg3-jbf1-qyb1 |
|
|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-dhmc-f44a-sydn |
| vulnerability_id |
VCID-dhmc-f44a-sydn |
| summary |
|
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-34580 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.05951 |
| published_at |
2026-04-18T12:55:00Z |
|
| 1 |
| value |
0.00023 |
| scoring_system |
epss |
| scoring_elements |
0.06314 |
| published_at |
2026-04-09T12:55:00Z |
|
| 2 |
| value |
0.00023 |
| scoring_system |
epss |
| scoring_elements |
0.06273 |
| published_at |
2026-04-08T12:55:00Z |
|
| 3 |
| value |
0.00023 |
| scoring_system |
epss |
| scoring_elements |
0.06307 |
| published_at |
2026-04-11T12:55:00Z |
|
| 4 |
| value |
0.00023 |
| scoring_system |
epss |
| scoring_elements |
0.06302 |
| published_at |
2026-04-12T12:55:00Z |
|
| 5 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.08662 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.08774 |
| published_at |
2026-04-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-34580 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-34580
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dhmc-f44a-sydn |
|
| 1 |
| url |
VCID-u7m6-swgm-tqf9 |
| vulnerability_id |
VCID-u7m6-swgm-tqf9 |
| summary |
|
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-35580 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02899 |
| published_at |
2026-04-12T12:55:00Z |
|
| 1 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.0292 |
| published_at |
2026-04-11T12:55:00Z |
|
| 2 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.0295 |
| published_at |
2026-04-09T12:55:00Z |
|
| 3 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02925 |
| published_at |
2026-04-08T12:55:00Z |
|
| 4 |
| value |
0.00019 |
| scoring_system |
epss |
| scoring_elements |
0.0513 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.00019 |
| scoring_system |
epss |
| scoring_elements |
0.04949 |
| published_at |
2026-04-18T12:55:00Z |
|
| 6 |
| value |
0.00019 |
| scoring_system |
epss |
| scoring_elements |
0.05076 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-35580 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-35580, GHSA-3g6g-gq4r-xjm9
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u7m6-swgm-tqf9 |
|
|
| Risk_score | 4.1 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:deb/debian/botan3@3.10.0%252Bdfsg-2%3Fdistro=trixie |