HIGH

CVE-2026-12803

Bouncycastle Bc Java 2026-08-03 CVSS v3.1

CVSS

7.5

Description

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Summary dbcve.org

The KCCMBlockCipher in Bouncy Castle Java versions before 1.85 (and LTS before 2.73.12) fails to properly bind the nonce to the MAC when Additional Authenticated Data (AAD) is absent. This allows cross-nonce AEAD forgery, enabling an attacker to potentially forge valid MACs for different messages using different nonces when AAD is not used.

Mitigation

Upgrade Bouncy Castle for Java to version 1.85 or later, or LTS version 2.73.12 or later, then verify all cryptographic operations using KCCMBlockCipher continue to function correctly.

Patch Commit

Weakness (CWE)

CWE-354

EPSS Score

0.17%

Probability of exploitation in next 30 days

6.1th percentile

References

https://github.com/bcgit/bc-java/commit/697794413ebf7bc5e3fce609a707826ba52981af Patch https://github.com/bcgit/bc-java/commit/7d79aa76e984da85f2a541cae8ba2ae56e1713bc Patch https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012803 Third Party Advisory, Patch

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE