CVE-2026-32883: Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32883?
The severity of CVE-2026-32883 is classified as high due to the potential for a Man-in-the-Middle attack allowing certificate revocation bypass.
How do I fix CVE-2026-32883?
To fix CVE-2026-32883, upgrade Botan to version 3.11.0 or later where the vulnerability is resolved.
Who is affected by CVE-2026-32883?
CVE-2026-32883 affects users of Botan versions between 3.0.0 and before 3.11.0 that implement X509 path validation.
What impact does CVE-2026-32883 have on system security?
The impact of CVE-2026-32883 allows an attacker to potentially bypass certificate revocation checks, compromising secure communications.
What kind of attack can exploit CVE-2026-32883?
CVE-2026-32883 can be exploited in Man-in-the-Middle (MitM) attacks where revocation status of certificates is not adequately verified.