CVE‐2026‐12860

Title: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12.

Platform affected: Java 8 and later.

In org.bouncycastle.crypto.signers.RSADigestSigner.verifySignature(), the legacy branch that handles DigestInfo encoded without NULL AlgorithmIdentifier parameters computes comparison offsets as length - hash.length - 2, causing the two comparison loops to jointly cover bytes [0..sig.length-2) while leaving the last two bytes of the hash unverified. An attacker who can present a signature produced with the NULL-less encoding therefore only needs a message whose digest matches the signed digest in all but the final two bytes, shaving 2^16 off the second-preimage work factor. This path is reachable by default (unless org.bouncycastle.pkcs1.strict_digestinfo is set) from BC-lightweight TLS rsa_pkcs1_* verification, PKIX/CMS verification, and OpenPGP RSA verification. The sibling JCA DigestSignatureSpi has the corrected loop bound, confirming the defect.

The fix was introduced in commit ea5970ea9b2f.

Credit: Alex Gaynor in collaboration with Claude and Anthropic Research.