CVE‐2026‐58061

Title: CCM-family modes write plaintext to caller buffer before tag check.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Platform affected: Java 8 and later.

CCMBlockCipher.processPacket() (and the equivalent paths in KCCMBlockCipher and KGCMBlockCipher) decrypts ciphertext directly into the caller-supplied output array and only then checks the authentication tag. When the tag check fails, InvalidCipherTextException is thrown but the output buffer already holds the full unverified plaintext and is never zeroed; the JCE BaseBlockCipher doFinal wrapper does not wipe it either. An attacker who can submit forged ciphertexts and observe the output buffer on the failure path (via pooled-buffer reuse, logging, or memory inspection) obtains AES-CTR(key, nonce) XOR attacker-ciphertext, effectively turning CCM into an unauthenticated CTR decryption oracle. Because these modes buffer the full ciphertext internally, there is no API reason to emit plaintext before verification — GCMSIVBlockCipher shows the correct decrypt-to-private-buffer-then-copy pattern.

The fix was introduced in commit cd4a5ab3ad61 and commit 08d675106bb6.