{
  "cveId": "CVE-2026-32883",
  "url": "https://patchblox.com/security/cve/CVE-2026-32883",
  "summary": "CVE-2026-32883 is fixed in botan3 on 1 platform, first by DEBIAN-CVE-2026-32883, released March 30, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "botan3: Botan is a C\u002B\u002B cryptography library",
  "description": "Botan is a C\u002B\u002B cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.",
  "published": "2026-03-30T21:17:09Z",
  "severity": "medium",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "epss": 0.0016,
  "epssPercentile": 0.05236,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "botan3",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.11.0\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2026-32883",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-32883",
      "released": "2026-03-30T21:17:09Z"
    },
    {
      "platform": "linux",
      "product": "botan3",
      "release": "Debian 14",
      "fixedVersion": "3.11.0\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2026-32883",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-32883",
      "released": "2026-03-30T21:17:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}