CVE-2026-32883 describes a vulnerability in the Botan cryptography library (versions >= 3.0.0 and < 3.11.0) where during X509 path validation, the library checked OCSP response status codes but failed to verify the cryptographic signature of the OCSP response itself. This is classified under CWE-347 (Improper Verification of Cryptographic Signature). The lack of signature verification could allow invalid or malicious OCSP responses to be accepted as valid, potentially impacting the integrity of certificate validation processes. The vulnerability was patched in Botan version 3.11.0.

The vulnerability impacts the integrity of certificate validation by allowing OCSP responses to be accepted without verifying their cryptographic signatures. This could enable attackers to present forged OCSP responses that appear valid, potentially causing the system to trust revoked or invalid certificates. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild at this time.

A fix is available in Botan version 3.11.0. Users of affected versions (>= 3.0.0 and < 3.11.0) should upgrade to version 3.11.0 or later to ensure proper verification of OCSP response signatures during X509 path validation. No alternative mitigations are indicated.