CVE-2026-32883 MEDIUM

CVE-2026-32883: Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass

Vendor Randombit
Product botan
Weakness CWE-347
Published March 30, 2026
Last update April 2, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.

Key dates

02Disclosure timeline

March 30, 2026 CVE published
April 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-1366 Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability CVE-2026-6873 Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie CVE-2025-58356 Constellation allows insecure use of LUKS2 persistent storage partitions CVE-2026-33894 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVE-2025-29915 Suricata af-packet: defrag option can lead to truncated packets affecting visibility