CVE-2026-12802
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.
Risk Assessment
Missing tag verification allows an attacker to tamper with data or decrypt without proper authentication.
Recommendation
Upgrade Bouncy Castle to version 1.85 or later (or appropriate LTS/FIPS version).
Other vulnerabilities in Bouncy Castle
See all- CVE-2026-58062Critical
In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- CVE-2026-8763Critical
In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.
- CVE-2026-59650Critical
In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.
- CVE-2026-14682High
In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.
- CVE-2026-13586High
In Bouncy Castle for Java before 1.85, the PKCS#12 MAC and bag-decryption KDF iteration-count bound can lead to DoS. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.
- CVE-2026-13506High
In Bouncy Castle for Java before 1.85, a Lazy ASN.1 sequence forces resetting the nesting-depth guard. This issue also affects LTS and FIPS versions.
- CVE-2026-12860Medium
In Bouncy Castle for Java before 1.85, RSA PKCS#1 signature verification skips the last two hash bytes in the NULL-omitted path. This issue also affects LTS before 2.73.12.
- CVE-2026-12852High
In Bouncy Castle for Java before 1.85, the MLS wire decoder allocates attacker-declared opaque length before bounds check.
- CVE-2026-12817High
In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips the final tag on chunk-aligned data. This issue also affects LTS and FIPS versions.
- CVE-2026-12816High
In Bouncy Castle for Java before 1.85, the IESEngine in stream mode allows MAC forgery via length-dependent KDF split. This issue also affects LTS before 2.73.12.
Original NVD description (English source)
In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).