CVE-2026-118768
Description
A flaw was found in botan. The command-line utility fails to verify the cryptographic signature and authorization of Online Certificate Status Protocol (OCSP) responses. An on-path network attacker or malicious responder can exploit this vulnerability by returning a forged response with an invalid signature, causing revoked digital certificates to be accepted as valid.
Statement
This vulnerability has been rated as having a Moderate impact because it is restricted to the standalone botan ocsp_check binary command rather than affecting core cryptographic APIs or library functions. Exploitation requires an attacker to be in an on-path position or operate a malicious OCSP responder to forge validation responses. Furthermore, Botan is not distributed with Red Hat Enterprise Linux core releases and is only maintained through Fedora and Extra Packages for Enterprise Linux (EPEL) repositories.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
