CVE-2026-32883
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Summary
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Original description
The description as published by the source.
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2026-32883 botan3 Fixed in: 3.11.0-r0
- Debian DEBIAN-CVE-2026-32883 botan3 Fixed in: 3.11.0+dfsg-2
- Ubuntu UBUNTU-CVE-2026-32883 botan1.10
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov