CVE-2026-118766: Botan: Online OCSP redirects enable blind requests to internal HTTP services
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Botan's online OCSP client before version 3.13.0 are exposed when they process a certificate whose Authority Information Access extension directs OCSP traffic to an attacker-controlled responder, or when an attacker can interfere with the OCSP HTTP connection.
What does an attacker need to exploit it?
An attacker needs to control the OCSP responder referenced by the certificate or act as an on-path attacker able to return an HTTP redirect. No authentication or user interaction is required.
What can the redirected request do?
The client can be induced to make one blind HTTP request to an otherwise unreachable internal service. The request may affect services with non-idempotent GET handlers, and response timing can reveal coarse information about internal service availability.
What should be done if upgrading cannot happen immediately?
The provided information identifies version 3.13.0 as the fix, but does not specify a workaround. Until upgraded, limiting access from the OCSP client to internal HTTP services can reduce exposure to redirected requests.