Executive brief
Bouncy Castle is a widely-used cryptographic library that implements OpenPGP (Pretty Good Privacy) encryption standards. A weakness in the CFB (Cipher Feedback) mode implementation allows attackers to perform an oracle attack on symmetric encryption keys used in OpenPGP message decryption. An attacker with network access to a service using vulnerable Bouncy Castle versions could potentially recover encrypted session keys, compromising the confidentiality of OpenPGP-encrypted communications.
Technical details
The vulnerability is a CFB mode quick-check oracle in OpenPGP symmetric/session-key paths within Bouncy Castle for Java. The vulnerability allows attackers to perform timing or response-based oracle attacks to recover information about encrypted session keys during decryption operations. The flaw affects Bouncy Castle for Java before version 1.85, Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) in multiple version series (before 1.0.13 for 1.0.X, before 2.0.13 for 2.0.X, and before 2.1.13 for 2.1.X). The attack is network-accessible and requires repeated oracle queries but no special authentication. Patches are available in the indicated versions.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.85
- Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
- Bouncy Castle Bouncy Castle for Java FIPS bcpg-fips before 1.0.13 (1.0.X), before 2.0.13 (2.0.X), before 2.1.13 (2.1.X)
Timeline
- 2026-08-03: disclosed