Fedora has issued an advisory on July 11: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/F267ELFKGRI2VYNNBWENHA7VOV4YBUIH/ The issue is fixed upstream in 2.7.0.
CC: (none) => shlomif
Botan2 has been updated to the latest version in cauldron.
Resolution: (none) => FIXEDStatus: NEW => RESOLVED