CVE-2026-12803 in Bouncy Castle for Java
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java represents a critical cryptographic flaw that undermines the security assurances provided by authenticated encryption with additional data mechanisms. This weakness specifically impacts the KCCMBlockCipher implementation where the Message Authentication Code fails to properly bind the nonce to the authentication tag when additional authenticated data is not present. The root cause lies in the improper handling of nonce binding within the AEAD (Authenticated Encryption with Associated Data) construction, creating a scenario where an attacker can forge valid ciphertexts by manipulating nonce values across different encryption operations.
The technical implementation flaw stems from the failure to ensure that the nonce value is cryptographically bound to the authentication tag during the encryption process. When AAD is absent, the cipher does not enforce proper nonce binding mechanisms that should prevent cross-nonce forgery attacks. This vulnerability allows attackers to take a valid ciphertext encrypted under one nonce and modify it to appear authentic when decrypted under a different nonce, effectively breaking the authenticity guarantees of the encryption scheme. The issue manifests as a failure in the cryptographic integrity checks that should prevent such nonce reuse or cross-nonce operations from succeeding.
The operational impact of this vulnerability extends across numerous security-sensitive applications that rely on Bouncy Castle's cryptographic implementations for secure communications and data protection. Systems utilizing this library for TLS connections, encrypted file storage, or secure messaging protocols become vulnerable to active attacks where adversaries can craft forged messages that pass authentication checks. The vulnerability affects both the standard Bouncy Castle releases and the long-term support versions, indicating a widespread exposure across different deployment scenarios and maintenance cycles.
From a cybersecurity perspective, this vulnerability maps directly to CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-310 (Cryptographic Issues) within the Common Weakness Enumeration framework. The attack pattern aligns with ATT&CK technique T1589.002 (Compromise Application Logs) and T1071.004 (Application Layer Protocol: DNS) as attackers may exploit this weakness to manipulate encrypted communications. Organizations using affected versions face potential data breaches, man-in-the-middle attacks, and unauthorized access to sensitive information. The vulnerability particularly impacts systems where nonce reuse patterns occur or where attackers can influence the encryption parameters through network-level manipulation.
The recommended mitigation strategy involves immediate upgrading to Bouncy Castle versions 1.85 or later for standard releases, and version 2.73.12 or later for LTS releases where the nonce binding issue has been properly addressed. Security teams should also implement monitoring for suspicious cryptographic operations and consider re-encrypting sensitive data that may have been processed using vulnerable versions. Additionally, organizations should review their cryptographic implementations to ensure proper nonce management practices are followed, including implementing strict nonce uniqueness requirements and employing robust key rotation policies to minimize the attack surface.