Blind SSRF Vulnerability in Botan C++ Cryptography Library

CVE-2026-118766

What is CVE-2026-118766?

Prior to version 3.13.0, the Botan C++ cryptography library's online OCSP client permitted a single HTTP redirect when posting an OCSP request to a URI specified in a certificate's Authority Information Access extension. This oversight potentially enables a malicious OCSP responder or an on-path attacker to redirect requests, allowing the client to make blind requests to otherwise unreachable internal HTTP services. This vulnerability is particularly concerning as it can affect internal services with non-idempotent GET handlers, and attackers may exploit response timing to create an internal-service oracle. The issue has been addressed in version 3.13.0.

References