CVE-2026-118768

Name of the Vulnerable Software and Affected Versions Botan versions 1.11.34 through 3.12.x

Description The ocsp check command in the command-line interface requests an OCSP (Online Certificate Status Protocol) response from a certificate's Authority Information Access URL but fails to verify the response signature or authorize the signer. This allows a malicious responder or on-path attacker to provide a timely GOOD response with an empty, invalid, or unauthorized signature, which could lead to a revoked certificate being incorrectly validated with an exit status 0 and an OK output.

Recommendations Update to version 3.13.0.