PT-2026-29125 · Botan · Botan

Harutokimura · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-32883

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Botan versions 3.0.0 through 3.10.9

Description Botan is a C++ cryptography library. During X509 path validation, versions prior to 3.11.0 did not verify the signature of Online Certificate Status Protocol (OCSP) responses, only checking for an appropriate status code. This could allow a man-in-the-middle (MitM) attack to bypass certificate revocation checks.

Recommendations Update to Botan version 3.11.0 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-32883

GHSA-9J2J-HQMC-HF5X

Affected Products

Botan

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32883.json · Exploit
• https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32883 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32883 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-32883 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32883 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32883 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32883 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32883 · Security Note
• https://security.alpinelinux.org/vuln/CVE-2026-32883 · Note
• https://twitter.com/cyberbivash/status/2038733932468764936 · Twitter Post
• https://twitter.com/CVEnew/status/2038916080819998984 · Twitter Post