Botan’s online OCSP client prior to version 3.13.0 allows a single HTTP redirect when it posts an OCSP request to the URI specified in a certificate’s Authority Information Access extension. The redirect can be controlled by a malicious OCSP responder or an on‑path attacker, causing the client to perform a blind request to an otherwise unreachable internal HTTP service. This results in blind server‑side request forgery that could trigger non‑idempotent GET handlers in internal services, and the timing of the response can provide a coarse internal‑service oracle. The weakness is identified by CWE‑918.

All installations of the randombit Botan cryptography library with versions older than 3.13.0 are affected. Any application that links against these older library versions and performs OCSP validation is susceptible.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at present. The likely attack vector involves a malicious OCSP responder or an on‑path attacker that can influence the OCSP request’s redirect target. Exploitation requires either control over certificate issuance or placement of a rogue OCSP responder in the network path, after which blind SSRF can be leveraged to probe or potentially affect internal HTTP services.