Bouncy Castle vulnerabilities

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. An attacker could present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path.

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.

In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.86, a vulnerability allows truncated OpenPGP encrypted messages to be accepted without error. On the SEIPD version 1 path, no integrity check is performed at all, and on the AEAD path (SEIPD v2 and v5), the trailing authentication tag is skipped, silently dropping packets after the literal. The issue also affects LTS before 2.73.13 and FIPS (BC-FJA) before specified versions, but only on the AEAD route.

In Bouncy Castle for Java before 1.86, the opt-in key-size validation for CMS key-transport recipients (JceKeyTransRecipient.setKeySizeValidation(true)) never ran for messages using RFC 9709 (id-alg-cek-hkdf-sha256). A faulty comparison (byte array vs OID) caused the check to be skipped, accepting keys of mismatched size. This also affects BC-FJA before bcpkix-fips 2.0.13 and 2.1.13.

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate accepted public keys built on a foreign ECC curve that merely shares BLS12-381's field characteristic. This allowed aggregate signatures to verify with a phantom signer, even without a signature for that key and message pair.

In Bouncy Castle for Java before 1.86, both copies of PKIXCertPathReviewer (org.bouncycastle.pkix.jcajce and the legacy org.bouncycastle.x509) failed to apply X.509 name constraints to the end-entity certificate. The checkNameConstraints method walked the path with a loop bound excluding index zero (the target certificate), so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or subjectAltName. As a result, a chain whose leaf violated a NameConstraints extension imposed by its issuing CA was reported as valid (isValidCertPath() returned true with an empty error list), while CertPathValidator rejected the identical chain.

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted third-party certifications or trust delegations from any component key of the issuing certificate, without requiring the component to have certification authority. An attacker could use a restricted subkey (e.g., signing-only or encryption-only) to issue a valid identity certification or trust delegation, which was then attributed to the primary key.

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. When an application passed the same Java array as both input and destination (e.g., encrypting in place over KeyParameter.getKey()), the later mode-0 release wrote the unchanged key bytes over the ciphertext, exposing the raw AES key. The fix releases read-only input arrays with JNI_ABORT, preventing the copy-back.

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, the raw JCA PBKDF2 provider, and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the PKCS#12 MAC and bag-decryption KDF iteration-count bound can lead to DoS. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, a Lazy ASN.1 sequence forces resetting the nesting-depth guard. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, RSA PKCS#1 signature verification skips the last two hash bytes in the NULL-omitted path. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the MLS wire decoder allocates attacker-declared opaque length before bounds check.

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips the final tag on chunk-aligned data. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the IESEngine in stream mode allows MAC forgery via length-dependent KDF split. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the KCCMBlockCipher MAC does not bind the nonce when AAD is absent, allowing cross-nonce AEAD forgery. This also affects Bouncy Castle for Java LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the BCFKS keystore load honors unbounded KDF cost from an untrusted file. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to the caller buffer before tag check. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the HSS public-key level count is unbounded, enabling huge memory allocation on verify. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, stringifying X.500 distinguished names has quadratic time complexity, causing excessive processing time. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, LDAP filter injection exists in the legacy jdk1.4 LDAPStoreHelper component.

In Bouncy Castle for Java before 1.85, the BKS keystore accepts a legacy version with a 16-bit integrity MAC key. This also affects Bouncy Castle for Java LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the OpenPGP user-attribute subpacket length is bounded only by JVM max memory. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the OpenPGP Argon2 S2K function honors attacker-chosen memory and passes. This also affects LTS before 2.73.12 and FIPS versions before specific bcpg-fips releases.

In Bouncy Castle for Java before 1.85, the CRMF/CMP password-MAC function honors an unbounded iteration count. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.

In Bouncy Castle for Java before 1.85, the DTLS handshake reassembler allocates a buffer from an unchecked 24-bit length. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the MLS hash-ratchet honors an arbitrary 32-bit generation counter from the sender.

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures are silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content is not bound to MAC when authAttrs are present. This issue also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the S/MIME validator trusts the signer-asserted signingTime for path validation. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the OpenPGP CFB quick-check oracle is active on symmetric/session-key paths. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the CMS verifySignatures method returns true for SignedData with zero signers. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the JSSE hostname verifier enables CN-fallback by default despite documented opt-in. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honor an unbounded KDF cost from input. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.

In Bouncy Castle for Java before 1.85, the BKS/UBER keystore allocates memory from untrusted lengths before integrity check. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java (versions 1.73 to 1.78), three ML-KEM (CRYSTALS-Kyber) routines divide polynomial coefficients by the modulus q, allowing an attacker who measures the timing of many decapsulations with the same private key to recover that key. This affects Poly.toMsg (KyberSlash1) and ciphertext compression functions (KyberSlash2).

A vulnerability in BC-LTS and BC-FJA libraries from Legion of the Bouncy Castle Inc. on X86_64 with AVX and AVX-512f extensions on Linux. The issue involves program files gcm128w, gcm512w, gcm128w.C, and gcm512w.C.

A broken or risky cryptographic algorithm vulnerability was found in Bouncy Castle libraries (BC-JAVA, BCPKIX-FIPS, BCPIX-LTS) in pkix modules. The issue affects files JcaContentVerifierProviderBuilder.Java and JcaContentVerfierProviderBuilder.Java.