CVE‐2026‐12802

Title: CMS AuthEnvelopedData fails to enforce tag-length on decryption.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Platform affected: Java 8 and later.

The CMS recipient classes recovered AuthEnvelopedData content without applying any minimum to the AEAD authentication-tag length declared in the content-encryption AlgorithmIdentifier — a field that is not itself covered by the tag. A message re-encoded to declare a truncated ICV was decrypted as readily as one carrying a full 128-bit tag, weakening forgery resistance in proportion to the truncation (for the CCM family the declarable minimum is 32 bits). The JCE and BC recipient implementations now accept a minimum tag size via setMinimumTagSize(); AbstractRecipient.checkTagSize() refuses an AEAD content-encryption algorithm whose declared tag is shorter, throwing CMSTagLengthException before any content is returned.

The fix was introduced in commit 0fefa539e6ac.

Credit: Alex Gaynor in collaboration with Claude and Anthropic Research.