Skip to main content

Improper Validation of Integrity Check Value

CVE-2026-58061

High
8.7/10

Summary

In Bouncy Castle for Java prior to 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS prior to 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) prior to bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-354 - Improper Validation of Integrity Check Value

The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References

Advisory Timeline

  • Published