CVE-2024-34703

Botan is a C++ cryptography library. X.509 certificates can identify
elliptic curves using either an object identifier or using explicit
encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker
could present an ECDSA X.509 certificate using explicit encoding where the
parameters are very large. The proof of concept used a 16Kbit prime for
this purpose. When parsing, the parameter is checked to be prime, causing
excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the
prime parameter of the elliptic curve to be at most 521 bits. No known
workarounds are available. Note that support for explicit encoding of
elliptic curve parameters is deprecated in Botan.