CriticalFix available
botan — security advisory
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
- Products
- botan
- Affected versions
- Not specified
- Fixed versions
- 2.5.0-r0
- CVEs
- CVE-2018-9127
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:01 UTC · Revision 1
Source evidence
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
osv:ALPINE-CVE-2018-9127
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
botan
Fixed versions: 2.5.0-r0
Complete source record
{
"id": "77f04c5cac517ce5fbd86889db09867014ef354c02860ded6fae8cee76d7f4c7",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2018-9127",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2018-9127",
"summary": "Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.",
"evidence": "osv:ALPINE-CVE-2018-9127",
"products": [
{
"name": {
"value": "botan",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "botan",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.0-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "ALPINE-CVE-2018-9127",
"aliases": [
"ALPINE-CVE-2018-9127"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.11"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.12"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.5.0-r0"
}
]
}
],
"package": {
"name": "botan",
"purl": "pkg:apk/alpine/botan?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-9127.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-23T17:17:55.307804658Z",
"provider": "osv",
"upstream": [
"CVE-2018-9127"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2018-9127"
]
},
"related_cves": [
{
"value": "CVE-2018-9127",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 415243,
"published_at": "2018-04-02T17:29:00.387+00:00"
}