Botan CVE-2026-118766

The target application must actually use Botan's online OCSP client for certificate revocation checking (online OCSP enabled) on a vulnerable version (<= 3.12.0). The attacker must either operate the OCSP responder referenced in a validated certificate's Authority Information Access extension, or be an on-path attacker able to modify the HTTP response to inject a redirect. Several factors strictly LIMIT impact: only a SINGLE redirect is followed; the redirected request is a bodyless GET; no cookies or authorization credentials are forwarded; the response is never returned to the attacker (blind); and meaningful impact requires the reachable internal service to expose a non-idempotent GET handler or to leak state via connection/response timing. The issue does not apply once upgraded to 3.13.0, where redirects are disabled by default.

This is a medium-severity, defense-in-depth issue rather than an urgent priority. The supplied CVSS 3.1 vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L, base 6.1) models an unauthenticated, low-complexity attack with a scope change (the affected internal service differs from the vulnerable Botan component) and only partial integrity/availability impact and no confidentiality impact - consistent with a BLIND SSRF where the attacker never sees the response. The vuln.today decision label is 'this_month', not act_now/emergency, which matches the signal picture: there is no CISA KEV listing (not actively exploited) and no public exploit code - the three references are the GHSA advisory, the fixing PR, and the fix commit, not PoC/exploit code. No EPSS score was provided in the input, so exploitation-probability cannot be weighed here. The signals are internally consistent (medium CVSS, no KEV, no PoC, this_month) with one caveat worth verifying: the input vector asserts AV:A (adjacent), but the advisory's own threat model - 'a malicious OCSP responder' referenced by a certificate's AIA extension - describes a network-reachable adversary, so a network vector (AV:N) is arguably more accurate; verify the intended vector with the vendor. The real-world impact is further blunted by the blind, single-request, no-credential-forwarding nature of the flaw, so this is a genuine but low-urgency SSRF rather than a high-CVSS/low-real-risk false alarm.

A victim application uses Botan's online OCSP client to validate certificates; an attacker who controls the OCSP responder named in a certificate's Authority Information Access extension (or is on-path and can modify the HTTP response) returns a single HTTP redirect pointing at an internal URL such as http://127.0.0.1/private-control?operation=export. Botan follows that one redirect as a bodyless GET, issuing a blind request to the otherwise-unreachable internal service; the attacker cannot read the response but can target non-idempotent GET handlers and use connection/response timing as a coarse internal-service oracle. No public exploit identified at time of analysis; the references are the advisory, fix PR, and commit only.