8.7
Élevée
CVE-2026-12803 In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD…
Description
In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| BC-JAVA 1.85 | premières → < 1.85 | 1.85 |
| BC-LTS-JAVA 2.73 | 2.73.0 → < 2.73.12 | 2.73.12 |
Autres CVE de BC-JAVA
Les 52 CVE de BC-JAVA →
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,…
8.7
Élevée
CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every…
7.1
Élevée
CVE-2026-18040
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)…
5.9
Moyenne
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509…
9.2
Critique