2 files changed, 172 insertions, 0 deletions
diff --git a/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch b/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch
new file mode 100644
index 0000000000..f207ee2caa
--- /dev/null
+++ b/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch
@@ -0,0 +1,171 @@
+From cbc8b341ea4b38c388e89682b86da107a9fdc38c Mon Sep 17 00:00:00 2001
+From: Jack Lloyd <jack@randombit.net>
+Date: Sun, 15 Mar 2026 11:17:22 -0400
+Subject: [PATCH] Fix name constraint DNS check when falling back to CN
+When verifying name constraints which restrict the set of allowed DNS names, the
+logic would first check the Subject Alternative Name if available, but if the
+SAN is absent then it would check the CN field of the issued name since that is
+a common fallback for DNS names when the SAN is missing.
+However this check failed to properly canonicalize the potential DNS name in the
+CN, allowing a mis-issued cert with a mixed-case CN field and absent SAN to
+bypass any imposed excludedSubtrees rules.
+CVE: CVE-2026-32884
+Upstream-Status: Backport [https://github.com/randombit/botan/commit/db8baebd92bded036da6faf8bf3c324b67de9cf4]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/lib/x509/name_constraint.cpp              | 16 +++++++---
+ .../Invalid_DNS_Excluded_Mixed_Case_CN.crt    | 19 ++++++++++++
+ .../Root_DNS_Excluded_Mixed_Case_CN.crt       | 19 ++++++++++++
+ src/tests/test_name_constraint.cpp            | 29 +++++++++++++++++++
+ 4 files changed, 79 insertions(+), 4 deletions(-)
+ create mode 100644 src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
+ create mode 100644 src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
+diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
+index e767624..8708b95 100644
+--- a/src/lib/x509/name_constraint.cpp
+++ b/src/lib/x509/name_constraint.cpp
+@@ -19,6 +19,14 @@ namespace Botan {
+ 
+ class DER_Encoder;
+ 
+namespace {
+
+std::string canonicalize_dns_name(std::string_view name) {
+   return tolower_string(name);
+}
+
+}  // namespace
+
+ std::string GeneralName::type() const {
+    switch(m_type) {
+       case NameType::Unknown:
+@@ -75,7 +83,7 @@ void GeneralName::decode_from(BER_Decoder& ber) {
+       m_type = NameType::DNS;
+       // Store it in case insensitive form so we don't have to do it
+       // again while matching
+-      m_name.emplace<DNS_IDX>(tolower_string(ASN1::to_string(obj)));
+      m_name.emplace<DNS_IDX>(canonicalize_dns_name(ASN1::to_string(obj)));
+    } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
+       m_type = NameType::URI;
+       m_name.emplace<URI_IDX>(ASN1::to_string(obj));
+@@ -174,7 +182,7 @@ GeneralName::MatchResult GeneralName::matches(const X509_Certificate& cert) cons
+          // Check CN instead...
+          for(const std::string& cn : dn.get_attribute("CN")) {
+             if(!string_to_ipv4(cn).has_value()) {
+-               score.add(matches_dns(cn, constraint));
+               score.add(matches_dns(canonicalize_dns_name(cn), constraint));
+             }
+          }
+       }
+@@ -421,7 +429,7 @@ bool NameConstraints::is_permitted(const X509_Certificate& cert, bool reject_unk
+                   return false;
+                }
+             } else {
+-               if(!is_permitted_dns_name(cn)) {
+               if(!is_permitted_dns_name(canonicalize_dns_name(cn))) {
+                   return false;
+                }
+             }
+@@ -540,7 +548,7 @@ bool NameConstraints::is_excluded(const X509_Certificate& cert, bool reject_unkn
+                   return true;
+                }
+             } else {
+-               if(is_excluded_dns_name(cn)) {
+               if(is_excluded_dns_name(canonicalize_dns_name(cn))) {
+                   return true;
+                }
+             }
+diff --git a/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt b/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
+new file mode 100644
+index 0000000..fe2c773
+--- /dev/null
+++ b/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
+@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDCTCCAfGgAwIBAgIUAbjRT6B+WHVf1Wo9JdFHlHegF1cwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI2MDMxNTE0NTM1MloXDTI3
+MDMxNTE0NTM1MlowFzEVMBMGA1UEAwwMU3ViLkVWSUwuQ09NMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsn1rve+kuZJd2udT4QEnjdws+YRT+lJI+rG/
+4OpljAcxQywCc6oHDY4ouaqOKdhT9+luvqRVSEnH3JfczT/D+wZD+gBOlgUqsmXp
+QasD8HSyHWdjyaLrkZuBGICoUZTh9a7ZOPuIQ2sblxOvBm3klndpSpXJC6sJsWAk
+tyU+5WdNz+ncTC82sFSY0YQLC2QvxckEP6Jxi4I+h9vANtWXCk6CRz/kT4dY3cD4
+VBFtAy+vUVYUZnLi48fEYlMt4rP64OerY7hjw8gE+66rmUQPml4+DAek+xJtL4Sl
+Q0SGytWE9tJb1zzICv4TNvj/+IKmbK4BCu7fVjOd2C64zNFTywIDAQABo00wSzAJ
+BgNVHRMEAjAAMB0GA1UdDgQWBBS6hC1DrVlXAq/GWDYl/UQbP4TmLTAfBgNVHSME
+GDAWgBQPZ2Gp3izLTRAUzQKCKRLbM5OA2DANBgkqhkiG9w0BAQsFAAOCAQEAcWBy
+f9+tJDDj7T7z4QziZnxIfKP7x7uP9wAlYGRpKcbbW6SHAg6DA1V5GBWHendkg1hb
+Nywy7pUFgJ0xlJ7KYr76Ylfa1BTUPT+gExJWvSmsg8WSQ4q3bOMVB1qRxWDv/8KY
+ZOT03KEzLyGL6ia9r/UFw1jibxS26Ff6qCE9EhDLA/4z0D/+9QzdLATuzSn/SLSR
+wtarLaWhCfOSpfRrekYhaSndG45BCKpUd99iWt1HA4LyjZe8/8cxsRkD8klaCalG
+8pRp+PolijzmYsrEXuG22Bq2idgxHTRvw8l4rBQrSdMWuWqqTdIpFIUrXNft0a5f
+d8RmhI6PZlPL43OCxw==
+-----END CERTIFICATE-----
+diff --git a/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt b/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
+new file mode 100644
+index 0000000..503206f
+--- /dev/null
+++ b/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
+@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDGjCCAgKgAwIBAgIUJj5ZhECZYOzt5qWnoN8DMcZzlzgwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI2MDMxNTE0NTM1MloXDTM2
+MDMxMjE0NTM1MlowFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtEqBgRHixpRodBHeqXrcttdKD3tpGG+S67tM
+WT1h+572k6EFIZ9RVfYokH32sNFNz8LNI5FwKKFTf/WaVhMdsqxaMrf/+06UzKdw
+7dKz+Q5uLGrygv6opSVqhojkjLZH78zmEER0Gba4Ac4FGq5pjafA2jtoIMDyQ2SV
+IpOy932WCajQL6IM20yHPQAsr0c0hoFP4RdbJPuiEVPfZv95VjEwwV0zMBFmiICk
+gItEDfiexBHEIvXAGNBModMHaBhUDzHZp0X7gNW/MD2ieiQGoLTyG/t7sKv0J3zV
+LnUpXVIrmHSIkGVfuc5EFOlq6OXZ/J29VjPEnVVeZARDhgyGRQIDAQABo14wXDAP
+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQPZ2Gp3izLTRAUzQKCKRLbM5OA2DAO
+BgNVHQ8BAf8EBAMCAQYwGgYDVR0eAQH/BBAwDqEMMAqCCGV2aWwuY29tMA0GCSqG
+SIb3DQEBCwUAA4IBAQA5RLYaZWVxFIKpZRM5ZBk4fDDlAvRl7NVhMeQO3DMyyIzw
+Bp7IIEgH0I6PlL4/02SzSaqUuVVXYyO1LhbgBlFnE1h818zz+jN06i0lUemuXGAo
+wnHBwLW+V/r0JBm4BbnbneCYHUFS07sfR9IjQqV9Futp2WILwieZ7Ib96xGuX96L
+f6pxYEd82rYSXa/K14HvMKXkzC3qe72V+/E1GOPZqzlbZFriYfRUHUOY6P7LjcWl
+3Z+aUQcG8vEHbJjTd+ZZzP2PICjLKgaX1acpBOUR6pelHgcUmuR3z86V/DD8TWsH
+BHDLLBxTje/8fL0PR4qo4r4F+2Cj+hXnY/TFVQ+W
+-----END CERTIFICATE-----
+diff --git a/src/tests/test_name_constraint.cpp b/src/tests/test_name_constraint.cpp
+index 61aff53..5daa343 100644
+--- a/src/tests/test_name_constraint.cpp
+++ b/src/tests/test_name_constraint.cpp
+@@ -69,6 +69,35 @@ class Name_Constraint_Tests final : public Test {
+ 
+ BOTAN_REGISTER_TEST("x509", "x509_path_name_constraint", Name_Constraint_Tests);
+ 
+// Verify that DNS constraints are case-insensitive also when falling back to the CN
+class Name_Constraint_Excluded_CN_Case_Test final : public Test {
+   public:
+      std::vector<Test::Result> run() override {
+         Test::Result result("X509v3 Name Constraints: excluded DNS with mixed-case CN and no SAN");
+
+         const Botan::X509_Certificate root(
+            Test::data_file("x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt"));
+         const Botan::X509_Certificate leaf(
+            Test::data_file("x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt"));
+
+         Botan::Certificate_Store_In_Memory trusted;
+         trusted.add_certificate(root);
+
+         const Botan::Path_Validation_Restrictions restrictions(false, 80);
+         const auto validation_time = Botan::calendar_point(2026, 6, 1, 0, 0, 0).to_std_timepoint();
+
+         const auto path_result = Botan::x509_path_validate(
+            leaf, restrictions, trusted, "" /* hostname */, Botan::Usage_Type::UNSPECIFIED, validation_time);
+
+         result.test_eq(
+            "validation result", path_result.result_string(), "Certificate does not pass name constraint");
+
+         return {result};
+      }
+};
+
+BOTAN_REGISTER_TEST("x509", "x509_name_constraint_excluded_cn_case", Name_Constraint_Excluded_CN_Case_Test);
+
+ #endif
+ 
+ }  // namespace
diff --git a/meta-oe/recipes-crypto/botan/botan_3.10.0.bb b/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
index b613dd2a04..0986a76557 100644
--- a/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
+++ b/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
@@ -7,6 +7,7 @@ SECTION = "libs"
 SRC_URI = "https://botan.randombit.net/releases/Botan-${PV}.tar.xz \
           file://CVE-2026-32877.patch \
           file://CVE-2026-32883.patch \
+           file://CVE-2026-32884.patch \
           "
 SRC_URI[sha256sum] = "fde194236f6d5434f136ea0a0627f6cc9d26af8b96e9f1e1c7d8c82cd90f4f24"

diff --git a/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch b/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch new file mode 100644 index 0000000000..f207ee2caa --- /dev/null +++ b/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch
@@ -0,0 +1,171 @@
		1	From cbc8b341ea4b38c388e89682b86da107a9fdc38c Mon Sep 17 00:00:00 2001
		2	From: Jack Lloyd <jack@randombit.net>
		3	Date: Sun, 15 Mar 2026 11:17:22 -0400
		4	Subject: [PATCH] Fix name constraint DNS check when falling back to CN
		5
		6	When verifying name constraints which restrict the set of allowed DNS names, the
		7	logic would first check the Subject Alternative Name if available, but if the
		8	SAN is absent then it would check the CN field of the issued name since that is
		9	a common fallback for DNS names when the SAN is missing.
		10
		11	However this check failed to properly canonicalize the potential DNS name in the
		12	CN, allowing a mis-issued cert with a mixed-case CN field and absent SAN to
		13	bypass any imposed excludedSubtrees rules.
		14
		15	CVE: CVE-2026-32884
		16	Upstream-Status: Backport [https://github.com/randombit/botan/commit/db8baebd92bded036da6faf8bf3c324b67de9cf4]
		17	Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
		18	---
		19	src/lib/x509/name_constraint.cpp \| 16 +++++++---
		20	.../Invalid_DNS_Excluded_Mixed_Case_CN.crt \| 19 ++++++++++++
		21	.../Root_DNS_Excluded_Mixed_Case_CN.crt \| 19 ++++++++++++
		22	src/tests/test_name_constraint.cpp \| 29 +++++++++++++++++++
		23	4 files changed, 79 insertions(+), 4 deletions(-)
		24	create mode 100644 src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
		25	create mode 100644 src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
		26
		27	diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
		28	index e767624..8708b95 100644
		29	--- a/src/lib/x509/name_constraint.cpp
		30	+++ b/src/lib/x509/name_constraint.cpp
		31	@@ -19,6 +19,14 @@ namespace Botan {
		32
		33	class DER_Encoder;
		34
		35	+namespace {
		36	+
		37	+std::string canonicalize_dns_name(std::string_view name) {
		38	+ return tolower_string(name);
		39	+}
		40	+
		41	+} // namespace
		42	+
		43	std::string GeneralName::type() const {
		44	switch(m_type) {
		45	case NameType::Unknown:
		46	@@ -75,7 +83,7 @@ void GeneralName::decode_from(BER_Decoder& ber) {
		47	m_type = NameType::DNS;
		48	// Store it in case insensitive form so we don't have to do it
		49	// again while matching
		50	- m_name.emplace<DNS_IDX>(tolower_string(ASN1::to_string(obj)));
		51	+ m_name.emplace<DNS_IDX>(canonicalize_dns_name(ASN1::to_string(obj)));
		52	} else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
		53	m_type = NameType::URI;
		54	m_name.emplace<URI_IDX>(ASN1::to_string(obj));
		55	@@ -174,7 +182,7 @@ GeneralName::MatchResult GeneralName::matches(const X509_Certificate& cert) cons
		56	// Check CN instead...
		57	for(const std::string& cn : dn.get_attribute("CN")) {
		58	if(!string_to_ipv4(cn).has_value()) {
		59	- score.add(matches_dns(cn, constraint));
		60	+ score.add(matches_dns(canonicalize_dns_name(cn), constraint));
		61	}
		62	}
		63	}
		64	@@ -421,7 +429,7 @@ bool NameConstraints::is_permitted(const X509_Certificate& cert, bool reject_unk
		65	return false;
		66	}
		67	} else {
		68	- if(!is_permitted_dns_name(cn)) {
		69	+ if(!is_permitted_dns_name(canonicalize_dns_name(cn))) {
		70	return false;
		71	}
		72	}
		73	@@ -540,7 +548,7 @@ bool NameConstraints::is_excluded(const X509_Certificate& cert, bool reject_unkn
		74	return true;
		75	}
		76	} else {
		77	- if(is_excluded_dns_name(cn)) {
		78	+ if(is_excluded_dns_name(canonicalize_dns_name(cn))) {
		79	return true;
		80	}
		81	}
		82	diff --git a/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt b/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
		83	new file mode 100644
		84	index 0000000..fe2c773
		85	--- /dev/null
		86	+++ b/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
		87	@@ -0,0 +1,19 @@
		88	+-----BEGIN CERTIFICATE-----
		89	+MIIDCTCCAfGgAwIBAgIUAbjRT6B+WHVf1Wo9JdFHlHegF1cwDQYJKoZIhvcNAQEL
		90	+BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI2MDMxNTE0NTM1MloXDTI3
		91	+MDMxNTE0NTM1MlowFzEVMBMGA1UEAwwMU3ViLkVWSUwuQ09NMIIBIjANBgkqhkiG
		92	+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsn1rve+kuZJd2udT4QEnjdws+YRT+lJI+rG/
		93	+4OpljAcxQywCc6oHDY4ouaqOKdhT9+luvqRVSEnH3JfczT/D+wZD+gBOlgUqsmXp
		94	+QasD8HSyHWdjyaLrkZuBGICoUZTh9a7ZOPuIQ2sblxOvBm3klndpSpXJC6sJsWAk
		95	+tyU+5WdNz+ncTC82sFSY0YQLC2QvxckEP6Jxi4I+h9vANtWXCk6CRz/kT4dY3cD4
		96	+VBFtAy+vUVYUZnLi48fEYlMt4rP64OerY7hjw8gE+66rmUQPml4+DAek+xJtL4Sl
		97	+Q0SGytWE9tJb1zzICv4TNvj/+IKmbK4BCu7fVjOd2C64zNFTywIDAQABo00wSzAJ
		98	+BgNVHRMEAjAAMB0GA1UdDgQWBBS6hC1DrVlXAq/GWDYl/UQbP4TmLTAfBgNVHSME
		99	+GDAWgBQPZ2Gp3izLTRAUzQKCKRLbM5OA2DANBgkqhkiG9w0BAQsFAAOCAQEAcWBy
		100	+f9+tJDDj7T7z4QziZnxIfKP7x7uP9wAlYGRpKcbbW6SHAg6DA1V5GBWHendkg1hb
		101	+Nywy7pUFgJ0xlJ7KYr76Ylfa1BTUPT+gExJWvSmsg8WSQ4q3bOMVB1qRxWDv/8KY
		102	+ZOT03KEzLyGL6ia9r/UFw1jibxS26Ff6qCE9EhDLA/4z0D/+9QzdLATuzSn/SLSR
		103	+wtarLaWhCfOSpfRrekYhaSndG45BCKpUd99iWt1HA4LyjZe8/8cxsRkD8klaCalG
		104	+8pRp+PolijzmYsrEXuG22Bq2idgxHTRvw8l4rBQrSdMWuWqqTdIpFIUrXNft0a5f
		105	+d8RmhI6PZlPL43OCxw==
		106	+-----END CERTIFICATE-----
		107	diff --git a/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt b/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
		108	new file mode 100644
		109	index 0000000..503206f
		110	--- /dev/null
		111	+++ b/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
		112	@@ -0,0 +1,19 @@
		113	+-----BEGIN CERTIFICATE-----
		114	+MIIDGjCCAgKgAwIBAgIUJj5ZhECZYOzt5qWnoN8DMcZzlzgwDQYJKoZIhvcNAQEL
		115	+BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI2MDMxNTE0NTM1MloXDTM2
		116	+MDMxMjE0NTM1MlowFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMIIBIjANBgkqhkiG
		117	+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtEqBgRHixpRodBHeqXrcttdKD3tpGG+S67tM
		118	+WT1h+572k6EFIZ9RVfYokH32sNFNz8LNI5FwKKFTf/WaVhMdsqxaMrf/+06UzKdw
		119	+7dKz+Q5uLGrygv6opSVqhojkjLZH78zmEER0Gba4Ac4FGq5pjafA2jtoIMDyQ2SV
		120	+IpOy932WCajQL6IM20yHPQAsr0c0hoFP4RdbJPuiEVPfZv95VjEwwV0zMBFmiICk
		121	+gItEDfiexBHEIvXAGNBModMHaBhUDzHZp0X7gNW/MD2ieiQGoLTyG/t7sKv0J3zV
		122	+LnUpXVIrmHSIkGVfuc5EFOlq6OXZ/J29VjPEnVVeZARDhgyGRQIDAQABo14wXDAP
		123	+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQPZ2Gp3izLTRAUzQKCKRLbM5OA2DAO
		124	+BgNVHQ8BAf8EBAMCAQYwGgYDVR0eAQH/BBAwDqEMMAqCCGV2aWwuY29tMA0GCSqG
		125	+SIb3DQEBCwUAA4IBAQA5RLYaZWVxFIKpZRM5ZBk4fDDlAvRl7NVhMeQO3DMyyIzw
		126	+Bp7IIEgH0I6PlL4/02SzSaqUuVVXYyO1LhbgBlFnE1h818zz+jN06i0lUemuXGAo
		127	+wnHBwLW+V/r0JBm4BbnbneCYHUFS07sfR9IjQqV9Futp2WILwieZ7Ib96xGuX96L
		128	+f6pxYEd82rYSXa/K14HvMKXkzC3qe72V+/E1GOPZqzlbZFriYfRUHUOY6P7LjcWl
		129	+3Z+aUQcG8vEHbJjTd+ZZzP2PICjLKgaX1acpBOUR6pelHgcUmuR3z86V/DD8TWsH
		130	+BHDLLBxTje/8fL0PR4qo4r4F+2Cj+hXnY/TFVQ+W
		131	+-----END CERTIFICATE-----
		132	diff --git a/src/tests/test_name_constraint.cpp b/src/tests/test_name_constraint.cpp
		133	index 61aff53..5daa343 100644
		134	--- a/src/tests/test_name_constraint.cpp
		135	+++ b/src/tests/test_name_constraint.cpp
		136	@@ -69,6 +69,35 @@ class Name_Constraint_Tests final : public Test {
		137
		138	BOTAN_REGISTER_TEST("x509", "x509_path_name_constraint", Name_Constraint_Tests);
		139
		140	+// Verify that DNS constraints are case-insensitive also when falling back to the CN
		141	+class Name_Constraint_Excluded_CN_Case_Test final : public Test {
		142	+ public:
		143	+ std::vector<Test::Result> run() override {
		144	+ Test::Result result("X509v3 Name Constraints: excluded DNS with mixed-case CN and no SAN");
		145	+
		146	+ const Botan::X509_Certificate root(
		147	+ Test::data_file("x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt"));
		148	+ const Botan::X509_Certificate leaf(
		149	+ Test::data_file("x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt"));
		150	+
		151	+ Botan::Certificate_Store_In_Memory trusted;
		152	+ trusted.add_certificate(root);
		153	+
		154	+ const Botan::Path_Validation_Restrictions restrictions(false, 80);
		155	+ const auto validation_time = Botan::calendar_point(2026, 6, 1, 0, 0, 0).to_std_timepoint();
		156	+
		157	+ const auto path_result = Botan::x509_path_validate(
		158	+ leaf, restrictions, trusted, "" /* hostname */, Botan::Usage_Type::UNSPECIFIED, validation_time);
		159	+
		160	+ result.test_eq(
		161	+ "validation result", path_result.result_string(), "Certificate does not pass name constraint");
		162	+
		163	+ return {result};
		164	+ }
		165	+};
		166	+
		167	+BOTAN_REGISTER_TEST("x509", "x509_name_constraint_excluded_cn_case", Name_Constraint_Excluded_CN_Case_Test);
		168	+
		169	#endif
		170
		171	} // namespace


diff --git a/meta-oe/recipes-crypto/botan/botan_3.10.0.bb b/meta-oe/recipes-crypto/botan/botan_3.10.0.bb index b613dd2a04..0986a76557 100644 --- a/meta-oe/recipes-crypto/botan/botan_3.10.0.bb +++ b/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
@@ -7,6 +7,7 @@ SECTION = "libs"
7	SRC_URI = "https://botan.randombit.net/releases/Botan-${PV}.tar.xz \	7	SRC_URI = "https://botan.randombit.net/releases/Botan-${PV}.tar.xz \
8	file://CVE-2026-32877.patch \	8	file://CVE-2026-32877.patch \
9	file://CVE-2026-32883.patch \	9	file://CVE-2026-32883.patch \
		10	file://CVE-2026-32884.patch \
10	"	11	"
11	SRC_URI[sha256sum] = "fde194236f6d5434f136ea0a0627f6cc9d26af8b96e9f1e1c7d8c82cd90f4f24"	12	SRC_URI[sha256sum] = "fde194236f6d5434f136ea0a0627f6cc9d26af8b96e9f1e1c7d8c82cd90f4f24"
12		13