CVE-2026-118767

    Dashboard / Vulnerabilities / CVE-2026-118767

    CVE-2026-118767

    Published: 29 Oct 2026Last Modified: 1 Nov 2026

    Summary: Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs

    Details: Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118767.json, https://github.com/randombit/botan/security/advisories/GHSA-w8gj-5xrm-gvrp, https://nvd.nist.gov/vuln/detail/CVE-2026-118767, https://github.com/randombit/botan/commit/5a4ac737e72e18a08eca848049e3dd38571c73b4, https://github.com/randombit/botan/pull/5814

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3d253c524e3e4f21a11c857ab0827fe34c2ee307
    Fixed -2a81eef56c96c237e590c27f9a75e60317c9c700

    Affected versions

    3.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118767 | CVE-DB