In Bouncy Castle for Java versions prior to 1.86, the key-size validation mechanism for CMS key-transport recipients using RFC 9709 HKDF content-encryption key derivation fails due to a logic error. Specifically, the code compares the encrypted-key byte array against an ASN1ObjectIdentifier, which always evaluates to false, causing the validation to fall back to checking the outer wrapper OID. Since this OID represents a key-derivation construction without a registered key size, the key-size validation is effectively bypassed. Consequently, messages with HKDF-derived content-encryption keys that do not match the advertised key size are accepted even when validation is enabled. The fix involves dispatching based on the inner content-encryption algorithm's OID, ensuring proper key-size validation. This vulnerability also affects Bouncy Castle for Java FIPS versions before bcpkix-fips 2.0.13 and 2.1.13.

The vulnerability allows CMS key-transport recipients to accept encrypted messages with mismatched key sizes when using HKDF key derivation, even if key-size validation is explicitly enabled. This silently defeats the only mechanism provided by the API to enforce recovered key size, potentially weakening cryptographic assurances. Messages without HKDF key derivation or recipients without validation enabled are not impacted. There is no indication of known exploits in the wild.

A fix is available in Bouncy Castle for Java version 1.86 and in Bouncy Castle for Java FIPS versions 2.0.13 and 2.1.13. Users should upgrade to these versions or later to ensure proper key-size validation when using CMS key-transport recipients with HKDF key derivation. No additional mitigation is necessary if upgrading is performed.