CVE-2026-59640 in Bouncy Castle for Java
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java represents a critical cryptographic weakness that affects multiple versions of the library across different release streams. This issue manifests as an openpgp cfb quick-check oracle that remains active on symmetric/session-key processing paths, creating a significant security risk for applications relying on these cryptographic components. The vulnerability impacts both standard and long-term support releases, indicating a widespread problem that has persisted across multiple maintenance branches of the library.
The technical flaw stems from the improper handling of cryptographic operations during OpenPGP cipher feedback mode processing. When symmetric or session keys are utilized in the quick-check oracle mechanism, the implementation reveals timing information or other side-channel characteristics that can be exploited by attackers to infer cryptographic key material. This weakness directly relates to the principles outlined in CWE-310, which addresses cryptographic issues involving improper handling of key material and side-channel information leakage. The vulnerability specifically affects the symmetric encryption pathways within the OpenPGP implementation, where the quick-check mechanism should not expose operational details to potential adversaries.
The operational impact of this vulnerability extends across numerous applications that depend on Bouncy Castle for Java's cryptographic capabilities, particularly those implementing OpenPGP encryption standards. Attackers could potentially exploit this oracle to perform key recovery attacks or gain information about session keys through timing analysis and other side-channel techniques. The vulnerability affects not only standard releases but also the long-term support versions and FIPS certified implementations, suggesting that organizations using these components across different security contexts face similar exposure risks. This cross-version impact increases the potential attack surface significantly.
Mitigation strategies for this vulnerability require immediate application of patches to all affected versions of Bouncy Castle for Java, including the standard releases before 1.85, LTS versions before 2.73.12, and FIPS implementations with specific version constraints. Organizations should prioritize upgrading their cryptographic libraries to versions that address the oracle issue in symmetric/session-key processing paths. The remediation process should include thorough testing of applications to ensure compatibility with patched releases while maintaining proper cryptographic security posture. Additionally, system administrators should monitor for any potential exploitation attempts through network monitoring and anomaly detection systems, as this vulnerability aligns with techniques described in ATT&CK framework under cryptographic attacks and information gathering phases that target cryptographic implementations.