Executive brief
Bouncy Castle for Java is a widely-used cryptographic library that implements secure messaging protocols. A flaw in the MLS (Messaging Layer Security) hash-ratchet component allows an attacker to arbitrarily manipulate a 32-bit generation counter, potentially compromising the forward secrecy guarantees of encrypted message streams. This could allow an attacker to replay or forge messages in applications relying on MLS-based encryption.
Technical details
The vulnerability exists in the MLS message-key hash-ratchet implementation in Bouncy Castle for Java before version 1.85. The issue stems from insufficient validation of the generation counter supplied by senders; the ratchet accepts arbitrary 32-bit counter values without proper bounds checking. An attacker with network access to intercept or influence MLS protocol messages could exploit this to bypass forward secrecy properties. The fix, committed to the bc-java repository, bounds the forward gap in the hash-ratchet by implementing proper counter validation. Patches are available in version 1.85 and later.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.85
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Fixed in version 1.85