CVE-2026-118766

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.13.0

Description The online OCSP client allows a single HTTP redirect when posting an OCSP request to the URI found in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker can redirect the client to perform a blind request to an internal HTTP service that is otherwise unreachable. This leads to blind Server-Side Request Forgery (SSRF), which may impact internal services using non-idempotent GET handlers. Additionally, response timing can act as a coarse internal-service oracle.

Recommendations Update to version 3.13.0.