CVE-2026-71888: Bouncy Castle AuthenticatedData parser cryptographic validation bypass

CVE-2026-71888 · Severity: info · Published 2026-10-03

Bouncy Castle is a widely-used cryptographic library that implements standards for signing and encrypting messages. A flaw in how it validates authenticated data messages allows an attacker to inject forged attributes (such as security labels or routing decisions) into a message without possessing the encryption key, even though the message content itself remains protected. Applications that make authorization or routing decisions based on these attributes could be manipulated by an attacker.

Vendors: Legion of the Bouncy Castle.

Quick answers

Is CVE-2026-71888 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71888 being exploited in the wild.
How severe is CVE-2026-71888?
Informational severity, published 3 October 2026.
Which products and versions are affected?
Legion of the Bouncy Castle Bouncy Castle for Java before 1.86; Legion of the Bouncy Castle Bouncy Castle for Java FIPS (bcpkix-fips) before 1.0.13 (1.0.X), before 2.0.13 (2.0.X), before 2.1.13 (2.1.X); Legion of the Bouncy Castle Bouncy Castle for Java FIPS (bcutil-fips) before 2.0.8 (2.0.X), before 2.1.8 (2.1.X); Legion of the Bouncy Castle Bouncy Castle for Java LTS before 2.73.13.
Is there a fix for CVE-2026-71888?
Yes: fixed in Bouncy Castle for Java 1.86; Bouncy Castle for Java LTS 2.73.13; Bouncy Castle for Java FIPS (bcpkix-fips) 1.0.13, 2.0.13, 2.1.13; Bouncy Castle for Java FIPS (bcutil-fips) 2.0.8, 2.1.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71888 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71888?
Check whether you run Legion of the Bouncy Castle Bouncy Castle for Java, Legion of the Bouncy Castle Bouncy Castle for Java FIPS (bcpkix-fips), Legion of the Bouncy Castle Bouncy Castle for Java FIPS (bcutil-fips) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Bouncy Castle for Java 1.86; Bouncy Castle for Java LTS 2.73.13; Bouncy Castle for Java FIPS (bcpkix-fips) 1.0.13, 2.0.13, 2.1.13; Bouncy Castle for Java FIPS (bcutil-fips) 2.0.8, 2.1.8

Technical details

The streaming CMS AuthenticatedData parser in Bouncy Castle for Java incorrectly validates RFC 5652 compliant messages by making authentication decisions based solely on the digestAlgorithm field before reading the authAttrs field that appears later in the SEQUENCE. This allows a message with digestAlgorithm absent but authAttrs present to bypass MAC verification of the attributes, even though RFC 5652 section 9.2 requires the MAC to cover the authAttrs DER encoding. An attacker able to modify messages in transit can insert or modify authenticated attributes without holding the content-MAC key.

Affected products

  • Legion of the Bouncy Castle Bouncy Castle for Java before 1.86
  • Legion of the Bouncy Castle Bouncy Castle for Java LTS before 2.73.13
  • Legion of the Bouncy Castle Bouncy Castle for Java FIPS (bcpkix-fips) before 1.0.13 (1.0.X), before 2.0.13 (2.0.X), before 2.1.13 (2.1.X)
  • Legion of the Bouncy Castle Bouncy Castle for Java FIPS (bcutil-fips) before 2.0.8 (2.0.X), before 2.1.8 (2.1.X)

Timeline

  • 2026-10-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.