CVE-2026-118767
Description
A flaw was found in Botan. Its Python bindings fail to properly reject embedded null characters when converting strings, causing bcrypt password hashing functions to truncate the input at the null byte. A remote attacker can exploit this flaw to bypass password length and complexity policies, as an application may validate a full password string while only the prefix before the null byte is hashed and checked.
Statement
This vulnerability is rated as Moderate impact because exploitation requires custom software to utilize Botan's Python interface specifically for bcrypt hashing while accepting unvalidated null characters from user input. Under typical Red Hat deployments, Botan is not part of core Enterprise Linux installations and is primarily consumed via supplemental community repositories such as EPEL. The security impact is constrained to the circumvention of password complexity or length enforcement rather than arbitrary code execution or credential disclosure. Furthermore, alternative password derivation mechanisms provided by the library, including Argon2 and scrypt, remain completely unaffected.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
