CVE-2026-118768 in Botan
Summary
by MITRE • 10/29/2026
Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within the Botan C++ cryptography library represents a critical failure in cryptographic verification logic, specifically affecting the Online Certificate Status Protocol (OCSP) checking functionality implemented via the ocsp_check command-line utility. Operating between versions 1.11.34 and 3.13.0, this flaw stems from an incomplete implementation of signature validation during the OCSP response processing workflow. When a client requests certificate status information by querying the Authority Information Access URL embedded within a digital certificate, it expects to receive a signed assertion from the Certificate Authority or its delegated responder. The core technical deficiency lies in the library's failure to verify the cryptographic signature attached to this OCSP response and to validate that the signer is authorized to issue such assertions for the queried subject. This omission effectively bypasses one of the primary security guarantees provided by PKI systems, which rely on digital signatures to ensure data integrity and authenticity.
From a technical perspective, an attacker capable of intercepting network traffic or controlling the OCSP responder can exploit this lack of verification by returning a syntactically correct but cryptographically invalid response. Specifically, the malicious actor can provide a GOOD status indication accompanied by an empty signature field, a malformed signature that fails standard validation checks, or a signature generated by an unauthorized private key. Because the Botan library does not enforce strict signature verification before accepting the result, it treats these fraudulent responses as legitimate. Consequently, even if the certificate in question has been revoked due to compromise or policy violation, the tool will incorrectly report the status as OK and exit with a success code of zero. This behavior creates a false sense of security for applications relying on this command-line utility for pre-connection validation or audit purposes.
The operational impact of this vulnerability is significant within environments that depend heavily on automated certificate revocation checking to maintain trust boundaries. If an application integrates the Botan library and utilizes its ocsp_check feature as part of its handshake process, it may inadvertently establish connections with compromised servers whose certificates have been revoked by their issuing authorities. This undermines the fundamental purpose of Certificate Revocation Lists and OCSP, which is to prevent communication with entities that are no longer trusted due to key compromise or misissuance. While the vulnerability is confined to the command-line interface and does not directly affect library functions used programmatically for other cryptographic operations, it poses a severe risk in security auditing tools, automated deployment scripts, and any custom application logic that parses the output of this specific utility to make trust decisions.
This flaw aligns with CWE-347, Improper Verification of Cryptographic Signature, as the system fails to adequately verify the authenticity of data before trusting it. Furthermore, from a threat modeling perspective using MITRE ATT&CK techniques, this vulnerability facilitates Man-in-the-Middle attacks where an adversary can spoof certificate status information to bypass security controls. It also relates to CWE-295, Improper Certificate Validation, as the validation process is incomplete regarding signature checks. To mitigate this risk, organizations must ensure that all instances of the Botan library are upgraded to version 3.13.0 or later, where the signature verification logic has been corrected. Until such an upgrade is performed in legacy systems relying on this specific CLI tool, alternative methods for verifying certificate revocation status should be employed, and reliance on the output of the vulnerable ocsp_check command for critical security decisions must be discontinued to prevent potential exploitation by network attackers or malicious responders.