Botan OCSP client redirects enable blind SSRF to internal services
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Botan before 3.13.0 contains a server-side request forgery flaw (CWE-918) in its online OCSP client. The client follows one HTTP redirect when it posts an OCSP request to a certificate's Authority Information Access URI. A malicious OCSP responder or on-path attacker can redirect it to make one blind request to an otherwise unreachable internal HTTP service, which may affect services with GET handlers that are not idempotent.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Botan to version 3.13.0, which fixes this issue. Red Hat has no fix plan available for Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 and Red Hat Hardened Images.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA botan (randombit) Fixed in 3.13.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix yet |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118766
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-07 Affected versions changed · Red Hat
References
More randombit vulnerabilities
- TI-2024-33818 Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced… CVSS 3.1MEDIUM 5.9
- TI-2024-33817 Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced… CVSS 3.1MEDIUM 5.9
- TI-2016-02004 Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before… CVSS 3.0CRITICAL 9.8
- TI-2016-02005 Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27… CVSS 3.0CRITICAL 9.8
- TI-2026-26828 Botan has a certificate authentication bypass due to trust anchor confusion CVSS 4.0CRITICAL 9.3
- TI-2016-07479 In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-118766 · CVE Program
- CVE-2026-118766 · NVD
- FIRST EPSS
- CVE-2026-118766 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences