Executive brief
Bouncy Castle is a widely-used cryptographic library for Java that handles digital signatures and encrypted communications. In affected versions, CMS (Cryptographic Message Syntax) authenticated messages with certain attributes can bypass MAC (message authentication code) verification, allowing an attacker to forge or tamper with authenticated messages without detection.
Technical details
This vulnerability is a cryptographic bypass in CMS AuthenticatedData processing. When authenticated attributes (authAttrs) are present, the content is not properly bound to the MAC calculation, allowing an attacker to forge or modify the authenticated data. The vulnerability affects Bouncy Castle for Java versions before 1.85, Java LTS before 2.73.12, and FIPS variants (BC-FJA) in multiple series (before 1.0.12 for 1.0.X, before 2.0.12 for 2.0.X, and before 2.1.12 for 2.1.X). Attack requires network access to systems using the vulnerable library for CMS message processing, and no authentication is required. An attacker can forge cryptographically authenticated messages or tamper with existing ones. Patches are available in the versions listed above.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.85
- Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
- Bouncy Castle Bouncy Castle for Java FIPS bcpkix-fips before 1.0.12 (1.0.X), before 2.0.12 (2.0.X), before 2.1.12 (2.1.X)
Timeline
- 2026-08-03: disclosed