CVE-2026-13586

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. An attacker could present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path.

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.

In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.86, a vulnerability allows truncated OpenPGP encrypted messages to be accepted without error. On the SEIPD version 1 path, no integrity check is performed at all, and on the AEAD path (SEIPD v2 and v5), the trailing authentication tag is skipped, silently dropping packets after the literal. The issue also affects LTS before 2.73.13 and FIPS (BC-FJA) before specified versions, but only on the AEAD route.

In Bouncy Castle for Java before 1.86, the opt-in key-size validation for CMS key-transport recipients (JceKeyTransRecipient.setKeySizeValidation(true)) never ran for messages using RFC 9709 (id-alg-cek-hkdf-sha256). A faulty comparison (byte array vs OID) caused the check to be skipped, accepting keys of mismatched size. This also affects BC-FJA before bcpkix-fips 2.0.13 and 2.1.13.

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate accepted public keys built on a foreign ECC curve that merely shares BLS12-381's field characteristic. This allowed aggregate signatures to verify with a phantom signer, even without a signature for that key and message pair.

In Bouncy Castle for Java before 1.86, both copies of PKIXCertPathReviewer (org.bouncycastle.pkix.jcajce and the legacy org.bouncycastle.x509) failed to apply X.509 name constraints to the end-entity certificate. The checkNameConstraints method walked the path with a loop bound excluding index zero (the target certificate), so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or subjectAltName. As a result, a chain whose leaf violated a NameConstraints extension imposed by its issuing CA was reported as valid (isValidCertPath() returned true with an empty error list), while CertPathValidator rejected the identical chain.

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted third-party certifications or trust delegations from any component key of the issuing certificate, without requiring the component to have certification authority. An attacker could use a restricted subkey (e.g., signing-only or encryption-only) to issue a valid identity certification or trust delegation, which was then attributed to the primary key.

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. When an application passed the same Java array as both input and destination (e.g., encrypting in place over KeyParameter.getKey()), the later mode-0 release wrote the unchanged key bytes over the ciphertext, exposing the raw AES key. The fix releases read-only input arrays with JNI_ABORT, preventing the copy-back.