CVE-2026-32883
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
CVE-2026-32883- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2026-17211
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
EUVD-2026-17211- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
NVD
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
CVE-2026-32883- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-32883
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
ALPINE-CVE-2026-32883- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
CVE-2026-32883- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-32883
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
DEBIAN-CVE-2026-32883- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-32883
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
- Record
UBUNTU-CVE-2026-32883- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
botan3Alpine:v3.24 |
before 3.11.0-r0 | 3.11.0-r0 |
botan3Debian:13 |
before 3.11.0+dfsg-2, plus listed versions 3.10.0+dfsg-13.10.0+dfsg-23.11.0+dfsg-13.7.1+dfsg-23.8.1+dfsg-13.9.0+dfsg-13.9.0+dfsg-23.9.0+dfsg-2.1 |
3.11.0+dfsg-2 |
botan3Debian:14 |
before 3.11.0+dfsg-2, plus listed versions 3.10.0+dfsg-13.10.0+dfsg-23.11.0+dfsg-13.7.1+dfsg-23.8.1+dfsg-13.9.0+dfsg-13.9.0+dfsg-23.9.0+dfsg-2.1 |
3.11.0+dfsg-2 |
botan1.10Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.5-11.10.5-1ubuntu11.10.5-1+deb7u1ubuntu0.14.04.11.10.5-1+deb7u1ubuntu0.14.04.1+esm1 |
None known |
botan1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.10-61.10.12-1 |
None known |
botanUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.0-32.4.0-42.4.0-5ubuntu1 |
None known |
botan1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10.16-11.10.17-0.1 |
None known |
botanUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.0-22.9.0-2build12.12.1-22.12.1-2build1 |
None known |
botanUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.17.3+dfsg-32.19.1+dfsg-2ubuntu12.19.1+dfsg-2ubuntu1+esm1 |
None known |
botanUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.19.3+dfsg-1ubuntu12.19.3+dfsg-1ubuntu22.19.3+dfsg-1ubuntu2+esm1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
botanUbuntu:25.10 |
All versions, plus listed versions 2.19.5+dfsg-4 |
None known |
botan3Ubuntu:25.10 |
All versions, plus listed versions 3.7.1+dfsg-2 |
None known |
botan3Ubuntu:26.10 |
All versions, plus listed versions 3.10.0+dfsg-23.11.1+dfsg-23.12.0+dfsg-2 |
None known |
botan3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.7.1+dfsg-23.10.0+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32883 is a medium vulnerability (CVSS 5.9) in Botan Project Botan, published March 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in botan3 3.11.0-r0.
References
github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x
security.alpinelinux.org/vuln/CVE-2026-32883
nvd.nist.gov/vuln/detail/CVE-2026-32883
security-tracker.debian.org/tracker/CVE-2026-32883
ubuntu.com/security/CVE-2026-32883
cve.org/CVERecord?id=CVE-2026-32883