Medium WID-SEC-2026-3862 1 CVE

Bouncy Castle: Schwachstelle ermöglicht Offenlegung von Informationen

Published Oct 11, 2026 · Updated Oct 11, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann eine Schwachstelle in Bouncy Castle ausnutzen, um Informationen offenzulegen.

Product

Bouncy Castle ist eine Kryptographie-API für Java.

Vulnerabilities 1

High 8.2

CVE-2026-71884

Packet CTR reports a full success length after the counter is exhausted

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 byte…

Legion of the Bouncy Castle BC-LTS-JAVA

Oct 9, 2026

Revision history

2026-10-11 #1
Initiale Fassung

References

GitHub Advisory Database vom 2026-10-11
https://github.com/advisories/GHSA-QGFP-X9W9-PWJ2
bcgit GitHub vom 2026-10-11
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071884