randombit Botan up to 3.12.x Command-Line Interface ocsp_check certificate validation

Summaryinfo

A vulnerability was found in randombit Botan up to 3.12.x. It has been rated as problematic. This impacts the function ocsp_check of the component Command-Line Interface. This manipulation causes certificate validation. This vulnerability is handled as CVE-2026-118768. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in randombit Botan up to 3.12.x and classified as problematic. Affected by this vulnerability is the function ocsp_check of the component Command-Line Interface. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. The summary by CVE is:

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-118768 since 10/28/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

Upgrading to version 3.13.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• randombit

Name

• Botan

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12

License

• open-source

Website

• Product: https://github.com/randombit/botan/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion