CVE‐2026‐59651

Title: BKS keystore accepts legacy version with 16-bit integrity MAC key.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12.

Platform affected: Java 8 and later.

BcKeyStoreSpi.engineLoad() reads the keystore version from the file and accepts 0, 1, or 2. For versions other than 2 it calls generateDerivedMacParameters(hMac.getMacSize()), but getMacSize() returns bytes (20 for SHA-1) and PKCS12ParametersGenerator divides by 8, yielding a 2-byte (16-bit) MAC key. The default BKS type (BcKeyStoreSpi$Std) does not override engineLoad, and the org.bouncycastle.bks.enable_v1 property only gates the separate BKS-V1 alias, not this load path. Because the version integer is attacker-controlled, anyone who can supply or tamper with a .bks file can force the weak-key branch, brute-force the 2^16 keys offline, and produce a valid MAC over a modified store (e.g., injecting a rogue trusted CA).

The fix was introduced in commit faf5daa6e9b8.