Skip to main content

Improper Validation of Integrity Check Value in org.bouncycastle:bcpg-lts8on

CVE-2026-12816

  • org.bouncycastle:bcpg-lts8on
  • org.bouncycastle:bcprov-jdk18on
High
8.7/10

Summary

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-354 - Improper Validation of Integrity Check Value

The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References

Advisory Timeline

  • Published