CVE-2026-118767

Name of the Vulnerable Software and Affected Versions Botan versions 1.11.22 through 3.12.x

Description Botan's Python binding converts Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL. This causes the bcrypt() and check bcrypt() functions to process only the prefix before the NUL character. Consequently, applications may validate a longer password while hashing a shorter effective value, which can lead to a password-policy bypass.

Recommendations Update to version 3.13.0.