This vulnerability in BC-JAVA relates to an observable discrepancy in the OpenPGP CFB quick-check oracle active on symmetric/session-key paths. It affects Bouncy Castle for Java versions prior to 1.85 and versions from 2.73.0 up to 2.73.12. It also impacts Bouncy Castle for Java FIPS versions before bcpg-fips 1.0.13, 2.0.13, and 2.1.13 in their respective series. The issue is classified under CWE-203, indicating that an attacker can observe differences in behavior or output that may leak sensitive information. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows an attacker to exploit an observable discrepancy in the OpenPGP CFB quick-check process on symmetric/session-key paths, potentially leaking sensitive cryptographic information. This can compromise confidentiality of encrypted data processed by affected versions of BC-JAVA. The high CVSS score (8.7) indicates a significant risk if exploited, especially since no privileges or user interaction are required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding affected versions or applying any recommended workarounds from the vendor. Monitor official Bouncy Castle channels for updates regarding patches or mitigations.