CVE-2026-32883 Details
Description
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
A vulnerability in the Botan C++ cryptography library, affecting versions 3.0.0 prior to 3.11.0, allows a man-in-the-middle attacker to bypass certificate revocation checks. During X509 path validation, the library correctly assessed the status of OCSP responses but failed to verify the signatures of those responses. This oversight enables interception and tampering with OCSP response data without detection. The vulnerability arises because OCSP is typically deployed over plain HTTP, leaving it susceptible to interception through methods like DNS hijacking, BGP hijacking, or rogue network access points.
Users can upgrade to Botan version 3.11.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| botan project botan | >= 3.0.0, < 3.11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |