CVE-2026-71888: CWE-354 Improper Validation of Integrity Check Value in Legion of the Bouncy Castle Inc. BC-JAVA
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).
AI Analysis
Technical Summary
The vulnerability in Bouncy Castle for Java (BC-JAVA) before 1.86 and certain LTS and FIPS versions arises because the streaming CMS AuthenticatedData parser accepted messages where the digestAlgorithm and authAttrs fields disagreed about the presence of authenticated attributes. According to RFC 5652, authAttrs must be present whenever digestAlgorithm is, and the MAC covers either the DER encoding of authAttrs or the eContent OCTET STRING depending on their presence. The parser made its choice based solely on digestAlgorithm before reading authAttrs, allowing an attacker to insert authenticated attributes (e.g., ESSSecurityLabel) into a message without possessing the key-encryption or content-MAC keys. This could cause applications relying on these attributes for authorization or routing decisions to act on attacker-chosen values. The content remains MAC-bound and protected. The issue is a variant of CVE-2026-59642 but affects cases where digestAlgorithm is absent but authAttrs is present. The fix involves rejecting mismatched pairings and cross-checking fields during parsing. Affected versions include BC-JAVA before 1.86, LTS before 2.73.13, and various BC-FJA and bcutil-fips versions prior to their respective fixed releases.
Potential Impact
An attacker capable of modifying messages in transit can insert unauthenticated attributes into CMS AuthenticatedData messages, potentially influencing application decisions based on those attributes without possessing the necessary cryptographic keys. The actual content remains protected by the MAC, so content integrity is not compromised. This could lead to unauthorized authorization, routing, or labeling decisions in affected applications.
Mitigation Recommendations
A fix is available. Users should upgrade to Bouncy Castle for Java version 1.86 or later, LTS version 2.73.13 or later, BC-FJA versions 1.0.13, 2.0.13, or 2.1.13 or later, and bcutil-fips versions 2.0.8 or 2.1.8 or later. The updated libraries reject mismatched digestAlgorithm and authAttrs pairings during parsing and cross-check these fields to prevent this vulnerability.
CVE-2026-71888: CWE-354 Improper Validation of Integrity Check Value in Legion of the Bouncy Castle Inc. BC-JAVA
Description
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).
CVSS v4.0
Score 8.7high
Affected software
Legion of the Bouncy Castle Inc.
BC-JAVA
Legion of the Bouncy Castle Inc.
BC-JAVA
Legion of the Bouncy Castle Inc.
BC-LTS-JAVA
Legion of the Bouncy Castle Inc.
BC-FJA
Legion of the Bouncy Castle Inc.
BC-FJA
pkg:github/bcpkix-lts8onpkg:github/bcutil-lts8onRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Bouncy Castle for Java (BC-JAVA) before 1.86 and certain LTS and FIPS versions arises because the streaming CMS AuthenticatedData parser accepted messages where the digestAlgorithm and authAttrs fields disagreed about the presence of authenticated attributes. According to RFC 5652, authAttrs must be present whenever digestAlgorithm is, and the MAC covers either the DER encoding of authAttrs or the eContent OCTET STRING depending on their presence. The parser made its choice based solely on digestAlgorithm before reading authAttrs, allowing an attacker to insert authenticated attributes (e.g., ESSSecurityLabel) into a message without possessing the key-encryption or content-MAC keys. This could cause applications relying on these attributes for authorization or routing decisions to act on attacker-chosen values. The content remains MAC-bound and protected. The issue is a variant of CVE-2026-59642 but affects cases where digestAlgorithm is absent but authAttrs is present. The fix involves rejecting mismatched pairings and cross-checking fields during parsing. Affected versions include BC-JAVA before 1.86, LTS before 2.73.13, and various BC-FJA and bcutil-fips versions prior to their respective fixed releases.
Potential Impact
An attacker capable of modifying messages in transit can insert unauthenticated attributes into CMS AuthenticatedData messages, potentially influencing application decisions based on those attributes without possessing the necessary cryptographic keys. The actual content remains protected by the MAC, so content integrity is not compromised. This could lead to unauthorized authorization, routing, or labeling decisions in affected applications.
Mitigation Recommendations
A fix is available. Users should upgrade to Bouncy Castle for Java version 1.86 or later, LTS version 2.73.13 or later, BC-FJA versions 1.0.13, 2.0.13, or 2.1.13 or later, and bcutil-fips versions 2.0.8 or 2.1.8 or later. The updated libraries reject mismatched digestAlgorithm and authAttrs pairings during parsing and cross-check these fields to prevent this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- bcorg
- Date Reserved
- 2026-08-08T00:06:07.401Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac0c0f9a43b0b3b89b059ba
Added to database: 10/03/2026, 08:46:49 UTC
Last enriched: 10/03/2026, 09:01:08 UTC
Last updated: 10/04/2026, 05:45:56 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.