Skip to content

CVE‐2026‐12802

Jump to bottom
David Hook edited this page Aug 3, 2026 · 2 revisions

Title: CMS AuthEnvelopedData fails to enforce tag-length on decryption.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Platform affected: Java 8 and later.

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

The fix was introduced in commit 0fefa539e6ac.

Clone this wiki locally