CVE-2026-32883CWE-347

Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass

Medium · published March 30, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.3th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-03-30T20:36Z
EPSS history
Timeline
  • 30 MAR 20:36Z
    Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
    cvelistv5