What’s Vulnerable › Vulnerabilities
CVE-2026-32883: Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-30 · updated 2026-06-17
- Weakness: CWE-347
Description
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
Affected products
- randombit botan: from 3.0.0 before 3.11.0 — fixed in 3.11.0
How to fix
Upgrade to a fixed version: randombit botan 3.11.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-32883 or the next vulnerability affects your stack