Skip to content
OpenAdvisories
High WID-SEC-2026-3726 12 CVEs

Bouncy Castle für Java: Mehrere Schwachstellen

Published Oct 4, 2026 · Updated Nov 11, 2026 · Revision 8 · de

Vendor: IBM Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Integration Bus Product: License Metric Tool Product: Linux Product: openSUSE Product: SPSS

Summary

Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle für Java ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Bouncy Castle ist eine Kryptographie-API für Java.

Vulnerabilities 12

  • Critical 9.2
    CVE-2026-71885

    MLS X.509 credential not bound to the LeafNode signature key

    In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itsel…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu
  • High 8.7
    CVE-2026-71888

    CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent

    In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that auth…

    Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA BC-FJA Debian Ubuntu
  • High 8.7
    CVE-2026-71889

    PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

    In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkName…

    Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA BC-FJA Debian Ubuntu Wolfi
  • High 8.7
    CVE-2026-71890

    MLS external commit can remove an arbitrary group member

    In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu
  • High 8.2
    CVE-2026-71883

    Native AES packet cipher returns the raw AES key on an alias

    In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits th…

    Legion of the Bouncy Castle BC-LTS-JAVA
  • High 8.2
    CVE-2026-71886

    OpenPGP certification accepted from a subkey without certification authority

    In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to ce…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu Wolfi
  • High 8.2
    CVE-2026-71887

    OpenPGP data signature accepted from a signing subkey without cross-certification

    In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that binding omits a…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu Wolfi
  • High 8.2
    CVE-2026-85515

    OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

    In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext o…

    Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA BC-FJA Debian Ubuntu Wolfi
  • High 7.1
    CVE-2026-71891

    BLS12-381 key validation accepts a public key built on a foreign curve

    In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurv…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu Wolfi
  • Medium 6.9
    CVE-2026-71892

    CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

    In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivation (id-al…

    Legion of the Bouncy Castle BC-JAVA BC-FJA bouncycastle Debian Ubuntu
  • Medium 5.9
    CVE-2026-18040

    HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler

    In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu
  • Medium 5.3
    CVE-2026-97873

    Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

    In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictat…

    Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA bouncycastle Debian Ubuntu

Revision history

  1. #8

    Neue Updates von Red Hat aufgenommen

  2. #7

    Neue Updates von IBM und IBM-APAR aufgenommen

  3. #6

    Neue Updates von SUSE aufgenommen

  4. #5

    Neue Updates von openSUSE aufgenommen

  5. #4

    Neue Updates von IBM aufgenommen

  6. #3

    Neue Updates von SUSE, openSUSE, IBM und Red Hat aufgenommen

  7. #2

    Neue Updates von Red Hat aufgenommen

  8. #1

    Initiale Fassung

References