CVE-2026-32883 — Improper Verification of Cryptographic Signature in Project Botan
Severity
5.9MEDIUMNVD
EPSS
0.0%
top 96.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 30
Latest updateApr 1
Description
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages4 packages
🔴Vulnerability Details
1📋Vendor Advisories
2🕵️Threat Intelligence
5💬Community
4Bugzilla▶
CVE-2026-32883 botan2: Botan: Compromised certificate validation integrity via unverified OCSP response signatures [fedora-43]↗2026-04-01
Bugzilla▶
CVE-2026-32883 botan2: Botan: Compromised certificate validation integrity via unverified OCSP response signatures [epel-all]↗2026-04-01
Bugzilla▶
CVE-2026-32883 botan2: Botan: Compromised certificate validation integrity via unverified OCSP response signatures [fedora-42]↗2026-04-01
Bugzilla▶
CVE-2026-32883 botan3: Botan: Compromised certificate validation integrity via unverified OCSP response signatures [epel-all]↗2026-04-01