CVE-2026-32883

EUVD-2026-17211
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.08%
Affected Products (NVD)
VendorProductVersion
botan_projectbotan
3.0.0 ≤
𝑥
< 3.11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
botan
bookworm
2.19.3+dfsg-1+deb12u1
fixed
bullseye
2.17.3+dfsg-2
fixed
trixie
2.19.5+dfsg-4
fixed
botan3
forky
3.12.0+dfsg-2
fixed
sid
3.12.0+dfsg-2
fixed
trixie
vulnerable
trixie (security)
3.12.0+dfsg-2~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
botan
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
dne
botan3
jammy
dne
noble
dne
questing
ignored
resolute
needs-triage
botan1.10
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
ignored
Common Weakness Enumeration
References
https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x