« Volver al listado

CVE-2026-32883

Estado: AnalizadaMedia (5.9)—

Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Botan Project — Botan

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32883",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32883",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-02T14:09:48.050314Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "randombit",
          "product": "botan",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.11.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-30T21:17:09.933",
  "references": [
    {
      "url": "https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0."
    },
    {
      "lang": "es",
      "value": "Botan es una biblioteca de criptografía C++. Desde la versión 3.0.0 hasta antes de la versión 3.11.0, durante la validación de ruta X509, las respuestas OCSP se verificaban en busca de un código de estado apropiado, pero omitieron críticamente verificar la firma de la propia respuesta OCSP. Este problema ha sido parcheado en la versión 3.11.0."
    }
  ],
  "lastModified": "2026-06-17T10:36:30.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B92E460-5467-4D89-8840-A410CF83ED73",
              "versionEndExcluding": "3.11.0",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}