CVE-2026-16000: CWE-325 Missing Cryptographic Step in Legion of the Bouncy Castle Inc. bc-csharp
Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypted without associated data. The cause is that the G1 block, which binds the nonce, the message length and the parameter flags into the CBC-MAC, was processed only when associated data was present. Without associated data the tag was a CBC-MAC of the plaintext alone, independent of the nonce. Only applications that use KCcmBlockCipher directly and supply no associated data are affected.
AI Analysis
Technical Summary
The vulnerability in bc-csharp's DSTU 7624 CCM mode implementation (KCcmBlockCipher) before version 2.7.0 is due to a missing cryptographic step where the G1 block is not processed if no associated data is provided. This causes the authentication tag to be computed as a CBC-MAC of the plaintext alone, independent of the nonce, enabling an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags. Only applications that use KCcmBlockCipher directly and supply no associated data are vulnerable.
Potential Impact
An attacker capable of observing encrypted messages without associated data can forge ciphertexts with valid authentication tags, potentially compromising message integrity and authenticity. This undermines the cryptographic guarantees of the affected implementation, allowing forgery attacks. However, the vulnerability requires the attacker to observe messages encrypted without associated data and does not affect messages that include associated data.
Mitigation Recommendations
Upgrade to bc-csharp version 2.7.0 or later, where this vulnerability is fixed. Applications should ensure that associated data is supplied when using KCcmBlockCipher directly. Patch status is confirmed by the affectedVersions field indicating versions before 2.7.0 are vulnerable. No vendor advisory content is provided, so check the official Legion of the Bouncy Castle Inc. resources for the official fix.
CVE-2026-16000: CWE-325 Missing Cryptographic Step in Legion of the Bouncy Castle Inc. bc-csharp
Description
Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypted without associated data. The cause is that the G1 block, which binds the nonce, the message length and the parameter flags into the CBC-MAC, was processed only when associated data was present. Without associated data the tag was a CBC-MAC of the plaintext alone, independent of the nonce. Only applications that use KCcmBlockCipher directly and supply no associated data are affected.
CVSS v4.0
Score 8.7high
Affected software
Legion of the Bouncy Castle Inc.
bc-csharp
pkg:nuget/BouncyCastle.CryptographyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in bc-csharp's DSTU 7624 CCM mode implementation (KCcmBlockCipher) before version 2.7.0 is due to a missing cryptographic step where the G1 block is not processed if no associated data is provided. This causes the authentication tag to be computed as a CBC-MAC of the plaintext alone, independent of the nonce, enabling an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags. Only applications that use KCcmBlockCipher directly and supply no associated data are vulnerable.
Potential Impact
An attacker capable of observing encrypted messages without associated data can forge ciphertexts with valid authentication tags, potentially compromising message integrity and authenticity. This undermines the cryptographic guarantees of the affected implementation, allowing forgery attacks. However, the vulnerability requires the attacker to observe messages encrypted without associated data and does not affect messages that include associated data.
Mitigation Recommendations
Upgrade to bc-csharp version 2.7.0 or later, where this vulnerability is fixed. Applications should ensure that associated data is supplied when using KCcmBlockCipher directly. Patch status is confirmed by the affectedVersions field indicating versions before 2.7.0 are vulnerable. No vendor advisory content is provided, so check the official Legion of the Bouncy Castle Inc. resources for the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- bcorg
- Date Reserved
- 2026-07-16T23:53:32.558Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abfc5e2a43b0b3b89c8de25
Added to database: 10/02/2026, 14:55:30 UTC
Last enriched: 10/02/2026, 14:56:54 UTC
Last updated: 10/02/2026, 20:45:56 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.