CVE-2026-118768

    Dashboard / Vulnerabilities / CVE-2026-118768

    CVE-2026-118768

    Published: 29 Oct 2026Last Modified: 5 Nov 2026

    Summary: Botan: CLI utility `ocsp_check` accepts unauthenticated responses

    Details: Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118768.json, https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw, https://nvd.nist.gov/vuln/detail/CVE-2026-118768, https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983, https://github.com/randombit/botan/pull/5825

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b816a3652c1359028f59d64a2f742564547ab782
    Fixed -2a81eef56c96c237e590c27f9a75e60317c9c700

    Affected versions

    3.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118768 | CVE-DB