CVE-2026-58061 in BC-JAVA
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java affects the CCM-family cryptographic modes where plaintext data is written to the caller's buffer before the authentication tag verification occurs. This timing issue creates a potential race condition that can lead to information disclosure and integrity violations within cryptographic operations. The flaw exists across multiple versions of the Bouncy Castle library including both standard and Long Term Support releases, as well as the FIPS certified variants, indicating a widespread impact throughout the library's ecosystem.
This technical implementation flaw represents a deviation from proper cryptographic protocol design principles where authentication checks should always precede data exposure. The vulnerability allows for potential exploitation where an attacker could potentially manipulate the decryption process to extract plaintext information before tag validation occurs, effectively bypassing the intended security guarantees of the CCM mode. This issue aligns with CWE-295 which addresses improper certificate validation and CWE-310 which covers cryptographic issues related to authentication failures.
The operational impact of this vulnerability extends beyond simple data exposure as it can enable more sophisticated attacks including padding oracle vulnerabilities and potential plaintext recovery attacks. When cryptographic operations are performed in a manner that exposes plaintext before tag verification, it creates opportunities for attackers to infer information about the encrypted data or potentially manipulate the decryption process to achieve unauthorized access. The affected versions span across multiple release lines including the LTS 2.73.12 branch, BC-FJA 1.0.2.7, 2.0.2, and 2.1.3 series, suggesting that organizations using any of these releases may be vulnerable to attacks targeting the cryptographic integrity mechanisms.
Organizations should immediately upgrade to the patched versions of Bouncy Castle Java libraries to address this vulnerability. The recommended mitigation strategy includes updating all affected components to version 1.85 or later for standard releases, 2.73.12 or later for LTS releases, and the respective patched versions for BC-FJA. Security teams should also conduct comprehensive audits of systems using these cryptographic libraries to ensure no legacy code paths remain vulnerable. Additionally, organizations should review their cryptographic implementation practices to ensure proper ordering of operations where authentication checks occur before data exposure, following the principle of least privilege and defense in depth as outlined in the NIST SP 800-57 standard for cryptographic key management.