CVE-2026-118768

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118768", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T19:20:05.017Z", "datePublished": "2026-10-29T17:20:05.577Z", "dateUpdated": "2026-11-03T16:06:50.034Z"}, "containers": {"cna": {"title": "Botan: CLI utility `ocsp_check` accepts unauthenticated responses", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw"}, {"name": "https://github.com/randombit/botan/pull/5825", "tags": ["x_refsource_MISC"], "url": "https://github.com/randombit/botan/pull/5825"}, {"name": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983", "tags": ["x_refsource_MISC"], "url": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983"}], "affected": [{"vendor": "randombit", "product": "botan", "versions": [{"version": ">= 1.11.34, < 3.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T17:20:05.577Z"}, "descriptions": [{"lang": "en", "value": "Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0."}], "source": {"advisory": "GHSA-mpr7-9494-4qcw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T16:06:39.020869Z", "id": "CVE-2026-118768", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:06:50.034Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118768", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T16:06:39.020869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:06:46.676Z"}}], "cna": {"title": "Botan: CLI utility `ocsp_check` accepts unauthenticated responses", "source": {"advisory": "GHSA-mpr7-9494-4qcw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.9, "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "randombit", "product": "botan", "versions": [{"status": "affected", "version": ">= 1.11.34, < 3.13.0"}]}], "references": [{"url": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw", "name": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/randombit/botan/pull/5825", "name": "https://github.com/randombit/botan/pull/5825", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983", "name": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T17:20:05.577Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118768", "state": "PUBLISHED", "dateUpdated": "2026-11-03T16:06:50.034Z", "dateReserved": "2026-10-28T19:20:05.017Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T17:20:05.577Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "botan", "vendor": "randombit", "versions": [{"status": "affected", "version": ">= 1.11.34, < 3.13.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0."}], "id": "CVE-2026-118768", "lastModified": "2026-11-03T17:17:59.663", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118768", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T16:06:39.020869Z", "version": "2.0.3"}}]}, "published": "2026-10-29T18:17:28.997", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983"}, {"source": "security-advisories@github.com", "url": "https://github.com/randombit/botan/pull/5825"}, {"source": "security-advisories@github.com", "url": "https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "botan: botan: Certificate validation bypass via missing OCSP response signature verification", "id": "2563617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563617"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.", "A flaw was found in botan. The command-line utility fails to verify the cryptographic signature and authorization of Online Certificate Status Protocol (OCSP) responses. An on-path network attacker or malicious responder can exploit this vulnerability by returning a forged response with an invalid signature, causing revoked digital certificates to be accepted as valid."], "name": "CVE-2026-118768", "public_date": "2026-10-29T17:20:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118768\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118768\nhttps://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983\nhttps://github.com/randombit/botan/pull/5825\nhttps://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw"], "statement": "This vulnerability has been rated as having a Moderate impact because it is restricted to the standalone `botan ocsp_check` binary command rather than affecting core cryptographic APIs or library functions. Exploitation requires an attacker to be in an on-path position or operate a malicious OCSP responder to forge validation responses. Furthermore, Botan is not distributed with Red Hat Enterprise Linux core releases and is only maintained through Fedora and Extra Packages for Enterprise Linux (EPEL) repositories.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.11.34,3.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "botan", "source": "cna", "vendor": "randombit"}, "product": "botan", "vendor": "randombit"}], "created": "2026-10-29T18:30:14.422671+00:00", "updated": "2026-10-29T19:30:15.821256+00:00", "vendors": ["randombit", "randombit$PRODUCT$botan"]}