Medium severity · published Mar 30, 2026
CVE-2026-32883
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
botan · randombit
>= 3.0.0, < 3.11.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32883
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32883
Vendor Advisory
https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x
More from botan
9.1
CVE-2026-34582
Botan has a TLS 1.3 certificate authentication bypass
8.2
CVE-2026-32877
Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field
7.5
CVE-2026-44378
Botan: Quadratic complexity decoding BER indefinite length encodings
7.5
CVE-2026-34580
Botan has a certificate authentication bypass due to trust anchor confusion
5.9
CVE-2026-32884
Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)