CVE-2020-26939 in Bouncy Castle BC
Summary
by MITRE • 11/03/2020
In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/17/2025
The vulnerability identified as CVE-2020-26939 affects the Legion of the Bouncy Castle cryptographic library, specifically versions prior to 1.55 for BC and 1.0.1.2 for BC-FJA. This security flaw resides within the OAEP (Optimal Asymmetric Encryption Padding) encoding implementation, particularly in the org.bouncycastle.crypto.encodings.OAEPEncoding class. The vulnerability represents a side-channel attack vector that exploits observable differences in error handling behavior when processing malformed ciphertext inputs. This type of vulnerability falls under the CWE-209 category of Information Exposure Through an Error Message, where the system inadvertently reveals sensitive information through error responses.
The technical flaw manifests when the OAEP decoder processes invalid ciphertext that decrypts to a short payload. Under normal circumstances, the decryption process should handle all inputs uniformly, regardless of their validity. However, in affected versions, the implementation throws early exceptions when encountering certain invalid inputs that result in short decrypted payloads. This premature exception throwing creates observable timing or behavioral differences that attackers can exploit to infer information about the private RSA exponent. The vulnerability specifically targets the RSA private key operations within the cryptographic library, making it particularly dangerous for systems relying on RSA encryption with OAEP padding.
The operational impact of this vulnerability extends beyond simple information disclosure, as it represents a significant threat to RSA key security. Attackers who can consistently observe these behavioral differences may reconstruct portions of the private exponent through statistical analysis or mathematical inference techniques. This compromises the fundamental security assumptions of RSA encryption, potentially leading to full key recovery in severe cases. The vulnerability affects any system using the affected Bouncy Castle versions for RSA decryption operations with OAEP padding, making it relevant across various applications including web servers, database encryption, and secure communication protocols. The attack requires only the ability to send malformed ciphertext to the target system and observe the resulting error behavior.
Mitigation strategies for CVE-2020-26939 focus on upgrading to patched versions of the Bouncy Castle library where version 1.55 or later is required for BC and 1.0.1.2 or later for BC-FJA. Organizations should also implement proper input validation and ensure that cryptographic libraries are regularly updated as part of their security maintenance processes. The vulnerability aligns with ATT&CK technique T1005 by enabling data extraction through information disclosure, and represents a form of side-channel attack that demonstrates the importance of constant-time execution in cryptographic implementations. Additionally, this vulnerability highlights the need for robust error handling practices in cryptographic libraries where consistent behavior regardless of input validity is crucial for maintaining security properties.