CVE-2026-71884: CWE-323 Reusing a Nonce, Key Pair in Encryption in Legion of the Bouncy Castle Inc. BC-LTS-JAVA

In BC-LTS-JAVA versions >=2.73.4 and <2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fit the counter space left by the IV. Since the IV and block counter share a 16-byte block, an IV length of 13 to 15 bytes leaves only 1 to 3 bytes for the counter, which can address 256 to 16,777,216 blocks. If the input length exceeded this counter space, the counter wrapped causing the keystream to repeat within the same packet. This allowed two ciphertext segments to be encrypted under the same keystream, enabling plaintext recovery from ciphertext alone without the key. The native one-shot path lacked counter-range validation, unlike the streaming and portable implementations. The fix adds preflight validation to reject requests exceeding the counter range, ensuring failure-atomic operations that do not falsely report success. Versions of BC-LTS-JAVA before 2.73.13 are affected; bcprov is not affected due to no native code.

An attacker who obtains ciphertext encrypted with the vulnerable native one-shot CTR packet cipher can recover plaintext from ciphertext segments encrypted under the same keystream without needing the encryption key. This compromises confidentiality of encrypted data. The vulnerability does not affect the streaming implementation or the portable AESCTRPacketCipher. There are no known exploits in the wild. The CVSS 4.0 score is 8.2 (high severity), reflecting network attack vector, low attack complexity, and partial attack traceability.

A fix is available in BC-LTS-JAVA version 2.73.13 and later, which adds preflight validation to reject input lengths exceeding the counter space. Users should upgrade to version 2.73.13 or later to remediate this vulnerability. The streaming and portable AESCTRPacketCipher implementations are not vulnerable. No other mitigation is required.