CVE-2026-12860 in Bouncy Castle for Java
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java represents a critical cryptographic flaw that undermines the integrity of RSA PKCS#1 signature verification processes. This weakness specifically impacts the NULL-omitted path during signature validation, where the implementation fails to properly verify the final two bytes of the hash value. The issue affects multiple versions including the standard release line before 1.85 and the long-term support branch before 2.73.12, indicating a widespread problem that has persisted across different maintenance releases. From a cryptographic perspective, this represents a deviation from the established PKCS#1 v2.1 specification which mandates complete hash verification to ensure signature authenticity and prevent potential forgery attacks.
The technical implementation flaw occurs during the signature verification routine where Bouncy Castle employs an optimization technique for NULL-omitted signatures but incorrectly handles the final hash bytes. This creates a potential attack surface where malicious actors could craft signatures that pass validation despite being invalid, essentially bypassing the cryptographic security guarantees that RSA PKCS#1 verification is designed to provide. The vulnerability stems from improper boundary checking in the verification algorithm, where the implementation assumes that certain hash values can be safely omitted without proper validation, violating fundamental principles of cryptographic verification.
Operationally, this vulnerability poses significant risks to systems relying on Bouncy Castle for Java to validate digital signatures, particularly in environments where security is paramount such as financial transactions, software distribution, and secure communications. The impact extends beyond simple signature validation failure to potentially enable man-in-the-middle attacks, certificate forgery, or unauthorized system access through compromised signed components. Organizations using affected versions may unknowingly accept invalid signatures as valid, undermining the entire trust model that digital signatures are meant to establish.
Mitigation strategies must prioritize immediate version upgrades to Bouncy Castle 1.85 or LTS 2.73.12 respectively, which contain the necessary patches to correct the hash verification logic. Security teams should conduct comprehensive audits of all systems utilizing affected Bouncy Castle versions to identify and remediate any potential exploitation vectors. Additionally, organizations should implement monitoring for suspicious signature validation patterns and consider implementing additional cryptographic checks beyond the standard library verification. This vulnerability aligns with CWE-310 and ATT&CK techniques related to cryptographic attacks and signature validation bypasses, emphasizing the need for robust cryptographic implementation practices and regular security assessments. The fix addresses a direct violation of cryptographic best practices by ensuring complete hash verification as mandated by PKCS#1 standards.