Botan CVE-2026-32883

The CVSS 5.9 score with AV:N/AC:H reflects moderate severity with network accessibility but high complexity due to the need for specific network positioning. EPSS data is not provided, but the missing signature verification is a critical control bypass. The vulnerability is not confirmed as actively exploited (KEV status not provided), and no public exploit code has been identified in the available intelligence. However, the impact is significant: integrity is rated as HIGH (I:H), meaning an attacker can modify certificate status information. The high complexity requirement (AC:H) stems from the need to intercept or influence OCSP responses, limiting real-world exploitation but not eliminating it-particularly in enterprise or ISP-level attack scenarios. This is a genuine priority for applications relying on OCSP validation; it is not a low-real-risk high-CVSS case. Organizations using Botan for PKI operations should treat this as critical.

An attacker positioned on the network path between a Botan application and an OCSP responder could intercept OCSP requests and respond with a forged response claiming a revoked certificate is 'good', bypassing revocation checks. No signature verification means the fraudulent response is accepted as legitimate. This could allow use of a compromised or revoked TLS certificate in encrypted sessions, potentially enabling man-in-the-middle attacks or impersonation. Attack complexity is high because the attacker must intercept network traffic or compromise the OCSP responder, but the scenario is realistic in corporate networks or ISP-level compromises. No public exploit code has been identified at the time of analysis.