---
id: CVE-2026-118766
title: 'Botan: Online OCSP redirects enable blind requests to internal HTTP services'
summary: >-
  Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP
  client allowed a single HTTP redirect while posting an OCSP request to the URI
  in a certificate's Authority Information Access extension. A malicious OCSP
  responde…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-918
vendor: randombit
product: botan
affected:
  - botan < 3.13.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T01:32:43.783593Z'
published: '2026-10-29'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T01:32:53.304Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118766'
references:
  - url: 'https://github.com/randombit/botan/security/advisories/GHSA-9qgq-q9j4-4f82'
    label: 'https://github.com/randombit/botan/security/advisories/GHSA-9qgq-q9j4-4f82'
  - url: 'https://github.com/randombit/botan/pull/5815'
    label: 'https://github.com/randombit/botan/pull/5815'
  - url: >-
      https://github.com/randombit/botan/commit/9791ca39a556c76186b1fc943c7d8d460712d58f
    label: >-
      https://github.com/randombit/botan/commit/9791ca39a556c76186b1fc943c7d8d460712d58f
tags:
  - cve.org
epss: 0.00097
epssPercentile: 0.0071
ingestedAt: '2026-11-01T22:02:40.969Z'
---

## Overview

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.

## Affected

- `botan < 3.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.