Live › vulnerability › CVE-2026-118768
The botan ocsp_check command accepted OCSP responses without verifying their signature, so a revoked certificate could be reported as good. An attacker who can answer the OCSP request or sit on the network path can make a revoked certificate look valid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.
Only the botan command-line tool's ocsp_check command is affected, per the description; library use outside that command is not described as affected. Teams that run ocsp_check to decide whether a certificate is revoked are the ones relying on the wrong result. Teams that do not invoke this command can skip it.
No product ranges from the sources yet.
botan version and see whether it reports a version earlier than 3.13.0.ocsp_check use.3.13.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118768")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.