CVE‐2026‐12817

Title: OpenPGP AEAD decryption skips final tag on chunk-aligned data.

Issue affecting: BC before 1.85 (from 1.74), BC-LTS before 2.73.12, BC-FJA before bcpg-fips 1.0.13 (from 1.0.7), 2.0.13 and 2.1.13.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpg-fips 1.0.13 (from 1.0.7), 2.0.13 and 2.1.13.

Platform affected: Java 8 and later.

In PGPAeadInputStream.readBlock() (BcAEADUtil.java:438 and the mirrored JceAEADUtil.java), the final AEAD tag is verified only when the last chunk is shorter than chunkLength. When dataLen == chunkLength, the code pre-reads the next 16 bytes but ignores the readFully return value, and the following call sees dataLen == 0 and returns clean EOF without ever calling c.doFinal() on the final tag. RFC 9580 §5.13.2 relies on this final tag (which authenticates total byte count) to detect truncation, and PGPEncryptedData.verify() unconditionally returns true for AEAD, so there is no backstop. A network attacker who controls the ciphertext can strip trailing chunks plus the final tag, fix up the unauthenticated outer packet length, and have the recipient accept the truncated plaintext as authentic.

The fix was introduced in commit 4b712819846e.