CVE-2026-32883

Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass

State: Published
Severity: 5.9 Medium
Published: Mar 30, 2026
Updated: Apr 2, 2026
Reserved: Mar 16, 2026

Description

Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	GitHub_M

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
botanrandombit	>= 3.0.0, < 3.11.0Affected

References

https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.