CVE‐2026‐12803

Title: KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery).

Issue affecting: BC before 1.85, BC-LTS before 2.73.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12.

Platform affected: Java 8 and later.

In Bouncy Castle's DSTU 7624 CCM mode, processPacket() only calls processAAD() when associatedText.size() > 0, but processAAD() is the sole place where the G1 block (nonce || length || flag) is folded into macBlock. With no AAD, macBlock starts at all-zeros and CalculateMac() computes a plain zero-IV CBC-MAC over the plaintext, so the tag depends only on (key, plaintext) and not on the nonce. A chosen-plaintext attacker with access to an encryption oracle can use three queries to derive the data- and tag-keystream for two nonces and assemble a valid ciphertext+tag for any never-queried (plaintext, nonce) pair. The decryptor recomputes the same nonce-independent MAC and the constant-time tag check at line 359 passes, fully breaking AEAD authenticity.

The fix was introduced in commit 697794413ebf and commit 7d79aa76e984.