CVE-2026-8149
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in BC-LTS and BC-FJA libraries from Legion of the Bouncy Castle Inc. on X86_64 with AVX and AVX-512f extensions on Linux. The issue involves program files gcm128w, gcm512w, gcm128w.C, and gcm512w.C.
Risk Assessment
An attacker could exploit this vulnerability to compromise the confidentiality or integrity of data encrypted with GCM, potentially leading to sensitive information disclosure or data manipulation.
Recommendation
Immediately update BC-LTS to version 2.73.11 or later and BC-FJA to version 2.1.3 or later.
Other vulnerabilities in Bouncy Castle
See all- CVE-2026-58062Critical
In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- CVE-2026-8763Critical
In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.
- CVE-2026-59650Critical
In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.
- CVE-2026-14682High
In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.
- CVE-2026-13586High
In Bouncy Castle for Java before 1.85, the PKCS#12 MAC and bag-decryption KDF iteration-count bound can lead to DoS. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.
- CVE-2026-13506High
In Bouncy Castle for Java before 1.85, a Lazy ASN.1 sequence forces resetting the nesting-depth guard. This issue also affects LTS and FIPS versions.
- CVE-2026-12860Medium
In Bouncy Castle for Java before 1.85, RSA PKCS#1 signature verification skips the last two hash bytes in the NULL-omitted path. This issue also affects LTS before 2.73.12.
- CVE-2026-12852High
In Bouncy Castle for Java before 1.85, the MLS wire decoder allocates attacker-declared opaque length before bounds check.
- CVE-2026-12817High
In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips the final tag on chunk-aligned data. This issue also affects LTS and FIPS versions.
- CVE-2026-12816High
In Bouncy Castle for Java before 1.85, the IESEngine in stream mode allows MAC forgery via length-dependent KDF split. This issue also affects LTS before 2.73.12.
Original NVD description (English source)
A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f. This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C. This issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS