{"cve":"CVE-2024-34702","nvd":{"published":"2024-07-08T17:15:11.233","modified":"2026-06-17T07:33:54.357","status":"Deferred","description":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-405"],"references":["https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e","https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac","https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1","https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf","https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-34702","score":0.00845,"percentile":0.58043,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}