CVE-2026-32883

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32883
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*
History

13 Apr 2026, 13:54

Type Values Removed Values Added
First Time Botan Project botan
Botan Project
References () https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x - () https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x - Vendor Advisory
CPE cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*

01 Apr 2026, 14:24

Type Values Removed Values Added
Summary
  • (es) Botan es una biblioteca de criptografía C++. Desde la versión 3.0.0 hasta antes de la versión 3.11.0, durante la validación de ruta X509, las respuestas OCSP se verificaban en busca de un código de estado apropiado, pero omitieron críticamente verificar la firma de la propia respuesta OCSP. Este problema ha sido parcheado en la versión 3.11.0.

30 Mar 2026, 21:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-30 21:17

Updated : 2026-04-13 13:54

NVD link : CVE-2026-32883

Mitre link : CVE-2026-32883

CVE.ORG link : CVE-2026-32883

JSON object : View

Products Affected

botan_project

  • botan
CWE
CWE-347

Improper Verification of Cryptographic Signature