CVE-2026-32883 Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Attackers can bypass certificate revocation checks via Man-in-the-Middle attacks due to missing OCSP signature verification in Botan.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32883?
CVE-2026-32883 is a medium-severity vulnerability in randombit botan, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
Weakness: CWE-347
Which versions are affected by CVE-2026-32883?
It affects 1 product.
Products include Botan Project Botan.
How do I fix CVE-2026-32883?
Upgrade to a fixed version.
Is CVE-2026-32883 being exploited?
There is no known exploitation of CVE-2026-32883 in the wild and no public exploit code.
Other vulnerabilities in randombit botan
Sources
Also known as ALPINE-CVE-2026-32883, DEBIAN-CVE-2026-32883, GHSA-9j2j-hqmc-hf5x, UBUNTU-CVE-2026-32883.