# CVE-2026-85515: Bouncy Castle for Java truncated OpenPGP message acceptance

Source: https://junglewise.ai/threats/cve-2026-85515-in-bouncy-castle-for-java-before-1-86-a-truncated-openpgp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-85515 · Severity: info · Published 2026-10-03

Bouncy Castle for Java accepts truncated OpenPGP encrypted messages without raising an error, potentially allowing attackers to strip signatures and integrity checks from encrypted and signed communications. In certain truncation scenarios, particularly with SEIPD version 1 encryption, no integrity verification is performed at all, meaning altered plaintext can be accepted without detection. This could lead to message forgery or silent data tampering in applications using this library for encrypted communication.

Technologies: [Bouncy Castle for Java](https://junglewise.ai/threats/technologies/bouncy-castle-for-java). Vendors: [Bouncy Castle](https://junglewise.ai/threats/vendors/bouncy-castle).

## Quick answers

**Is CVE-2026-85515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85515 being exploited in the wild.

**How severe is CVE-2026-85515?** Informational severity, published 3 October 2026.

**Which products and versions are affected?** Bouncy Castle for Java before 1.86; Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.14 (1.0.X), 2.0.14.1 (2.0.X), 2.1.14 (2.1.X); Bouncy Castle for Java LTS before 2.73.13.

**Is there a fix for CVE-2026-85515?** Yes: fixed in Bouncy Castle for Java 1.86; Bouncy Castle for Java LTS 2.73.13; Bouncy Castle for Java FIPS bcpg-fips 1.0.14, 2.0.14.1, 2.1.14. Until then: Callers using the low-level API can invoke PGPEncryptedData.verify() directly to perform integrity checks regardless of truncation handling, bypassing the high-level stream vulnerability. Additionally, reading AEAD-decrypted data in increments of complete chunks rather than smaller portions avoids triggering the premature look-ahead that skips authentication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85515 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85515?** Check whether you run Bouncy Castle for Java, Bouncy Castle for Java FIPS (BC-FJA) or Bouncy Castle for Java LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Bouncy Castle for Java 1.86; Bouncy Castle for Java LTS 2.73.13; Bouncy Castle for Java FIPS bcpg-fips 1.0.14, 2.0.14.1, 2.1.14

Callers using the low-level API can invoke PGPEncryptedData.verify() directly to perform integrity checks regardless of truncation handling, bypassing the high-level stream vulnerability. Additionally, reading AEAD-decrypted data in increments of complete chunks rather than smaller portions avoids triggering the premature look-ahead that skips authentication.

## Technical details

The vulnerability involves incorrect handling of truncated OpenPGP packets across two encryption paths. On the SEIPD v1 path, IntegrityProtectedInputStream fails to verify the modification detection code because truncated messages never trigger the close() method that runs integrity checks; RFC 9580 requires explicit truncation errors but the implementation silently discards the EOFException. On the AEAD path (SEIPD v2 and version 5), premature look-ahead for the next packet can skip the trailing message tag that authenticates plaintext length, allowing signed packets to be silently stripped. The vulnerability requires no authentication or user interaction—it is triggered by the message structure itself, making it network-exploitable for any application consuming untrusted encrypted OpenPGP data.

## Affected products

- Bouncy Castle Bouncy Castle for Java before 1.86
- Bouncy Castle Bouncy Castle for Java LTS before 2.73.13
- Bouncy Castle Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.14 (1.0.X), 2.0.14.1 (2.0.X), 2.1.14 (2.1.X)

## Timeline

- 2026-10-03: disclosed

## Related threats

- [Bouncy Castle for Java BLS signature phantom signer](https://junglewise.ai/threats/cve-2026-71891-in-bouncy-castle-for-java-before-1-86-bls12-381basicscheme)
- [Bouncy Castle MLS external commit validation bypass](https://junglewise.ai/threats/cve-2026-71890-in-bouncy-castle-for-java-before-1-86-validation-of-an-mls-rfc)
- [Bouncy Castle for Java X.509 name constraints bypass in PKIXCertPathReviewer](https://junglewise.ai/threats/cve-2026-71889-in-bouncy-castle-for-java-before-1-86-neither-copy-of)
- [Bouncy Castle for Java OpenPGP signature misattribution in subkey binding validation](https://junglewise.ai/threats/cve-2026-71887-in-bouncy-castle-for-java-before-1-86-the-high-level-openpgp-api)
- [Bouncy Castle for Java OpenPGP certification validation bypass](https://junglewise.ai/threats/cve-2026-71886-in-bouncy-castle-for-java-before-1-86-the-high-level-openpgp)