CVE‐2026‐59640

Title: OpenPGP CFB quick-check oracle active on symmetric/session-key paths.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcpg-fips 1.0.13, 2.0.13 and 2.1.13.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpg-fips 1.0.13, 2.0.13 and 2.1.13.

Platform affected: Java 8 and later.

In Bouncy Castle's OpenPGP implementation, PGPSymmetricKeyEncryptedData.getDataStream() (reached via PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and the high-level OpenPGPMessageProcessor even for PKESK-unwrapped keys) still performs the CFB 'quick check' on the two repeated IV bytes and throws PGPDataValidationException before the MDC is verified. PGPPublicKeyEncryptedData already skips this check to avoid the Mister-Zuccherato oracle, but the symmetric/session-key path does not, and no system property gates it. An attacker with adaptive chosen-ciphertext access to a decryption endpoint can distinguish the early quick-check failure from later MDC/parse failures. This oracle lets them recover two plaintext bytes per roughly 2^15 queries against SEIPDv1 messages.

The fix was introduced in commit 6b94b1c146ce.