Botan ocsp_check EUVD-2026-113277

Exploitation requires that the target use the Botan command-line interface subcommand botan ocsp_check - the library's OCSP/path-validation API is NOT affected, which is the primary limiting factor. The attacker must be able to control the OCSP HTTP response body reaching the CLI: either by sitting on-path on the (typically plaintext HTTP) connection to the certificate's AIA URL, or by controlling the responder at that URL. The attacker needs NO OCSP signing certificate and NO private key - an empty, invalid, or unauthorized signature is accepted as long as the response is a matching, timely GOOD. A further prerequisite is that the certificate being checked is actually revoked (otherwise there is nothing to hide), and that an operator or automated process invokes the command (the UI:P requirement). Additional limits: the window is scoped to whatever consumes the CLI's exit code / 'OCSP check OK' output, and the fix in 3.13.0 is the only complete remedy stated by the vendor.

This is a medium-severity integrity flaw (CVSS 4.0 base 5.9) whose signals are internally consistent and point to a real-but-bounded priority rather than an emergency. The CVSS 4.0 vector AV:A/AC:L/AT:P/PR:N/UI:P shows an adjacent/on-path attacker (AT:P captures the requirement to sit on the OCSP HTTP path or control the responder), no privileges, but a passive user-interaction requirement (UI:P) because an operator or automated job must actually invoke the CLI subcommand. Impact is integrity-only (VI:H; VC/VA:N, no subsequent-system scope), reflecting that a revoked certificate is wrongly accepted as valid rather than any data disclosure or availability loss. No EPSS score and no KEV status were supplied in the input, and no public exploit or PoC reference is present (only the vendor advisory, fix PR, and commit) - so there is no evidence of active or widespread exploitation. The vuln.today decision label is this_month, consistent with a serious correctness/trust flaw that warrants scheduled remediation but is dampened by its narrow attack surface. The most important limiting fact is scope: the advisory and the diff confirm ONLY the command-line interface ocsp_check is affected, not the Botan library's OCSP API, which substantially narrows real-world exposure. Net: a genuine but not drop-everything issue - prioritize where the CLI feeds automated certificate-validation decisions.

An operator or CI/CD job uses botan ocsp_check to confirm a certificate has not been revoked. Because OCSP responders typically use plaintext HTTP, an on-path attacker intercepts the request to the certificate's AIA URL (or a malicious responder answers directly) and returns a matching, timely GOOD response carrying an empty, invalid, or unauthorized signature; the CLI skips signature verification and exits 0 with 'OCSP check OK', so a revoked certificate is treated as valid. No public exploit is identified, though the fix PR ships a regression test harness that demonstrates the acceptance of an unsigned GOOD response.