CVE-2016-2850: Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, wh...

Security readout for executives and security teams

This issue affects Botan 1.11.x before 1.11.29, a cryptography library used by applications for TLS. A remote attacker could potentially force weaker TLS choices because policy checks for signature algorithms and ECC curves were not enforced. The sources do not provide CVSS, active exploitation evidence, or attack specifics. Exposure is limited to applications or services that embed or link Botan 1.11.x before 1.11.29 for TLS handling. The source bundle does not identify specific downstream products beyond Fedora and Gentoo package advisories. Treat this as a targeted remediation item for systems using Botan-based TLS, especially public-facing services. It is not KEV-listed and lacks public exploit evidence in the provided sources, but downgrade risk can weaken encrypted communications. Mitigation focus: Upgrade Botan to 1.11.29 or a later vendor-supported release.; Apply relevant Fedora, Gentoo, or distribution package updates.; Check vendor guidance for any product-specific backports or configuration notes..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.