Executive brief
Bouncy Castle is a widely-used cryptographic library for Java applications. This vulnerability allows an attacker to bypass security validation in Diffie-Hellman key agreement operations by providing unvalidated peer values, potentially compromising the confidentiality and integrity of encrypted communications that rely on this library for key exchange.
Technical details
The vulnerability exists in the MTI/A0 Diffie-Hellman agreement implementation in Bouncy Castle for Java, which fails to properly validate peer-supplied values before performing modular exponentiation. An attacker can exploit this by providing specially crafted DH parameters that skip validation checks, potentially allowing cryptographic weakening or key recovery attacks. The issue affects Bouncy Castle for Java versions before 1.85 and Java LTS versions before 2.73.12. The vulnerability is network-reachable in applications that perform DH key agreement with untrusted peers, with no authentication required beyond the ability to participate in the key exchange protocol. Patches are available in the specified fixed versions.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.85
- Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
Timeline
- 2026-08-03: disclosed