CVE‐2026‐59650

Title: MTI/A0 DH agreement exponentiates unvalidated peer value.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12.

Platform affected: Java 8 and later.

In Bouncy Castle's DHAgreement (MTI/A0 two-pass variant), calculateAgreement(pub, message) raises the raw peer-supplied message to the power of the local static private key x without any range or subgroup-membership check. While the pub argument is validated by DHPublicKeyParameters, message is a bare BigInteger taken straight from the wire. A malicious peer can repeatedly send small-order elements (0, 1, p−1, or elements of small subgroups of (Z/pZ)*), and each exchange leaks x mod r for some small prime r; combining these via CRT recovers the full static private key (Lim–Lee 1997). DHBasicAgreement is unaffected because its single input passes through DHPublicKeyParameters validation.

The fix was introduced in commit daeaae9d7075.