Cross-Nonce AEAD Forgery in Bouncy Castle for Java
CVE-2026-12803

8.7HIGH

Key Information:

Vendor

Legion Of The Bouncy Castle Inc.

Status
Bc-java
Bc-lts-java
Vendor
CVE Published:
3 August 2026

What is CVE-2026-12803?

In Bouncy Castle for Java prior to version 1.85, the KCCMBlockCipher MAC implementation fails to bind nonce values when Additional Authenticated Data (AAD) is omitted. This flaw allows an attacker to exploit cross-nonce scenarios, potentially leading to AEAD forgery vulnerabilities. The impact is also present in the Long-Term Support (LTS) versions of Bouncy Castle for Java before 2.73.12, making it crucial for users to update to patched versions to mitigate security risks.

Affected Version(s)

BC-JAVA all 0 < 1.85

BC-LTS-JAVA all 2.73.0 < 2.73.12

References

https://github.com/bcgit/bc-java/wiki/CVE-2026-12803
vendor-advisory
https://github.com/bcgit/bc-java/commit/697794413ebf7bc5e...
patch
https://github.com/bcgit/bc-java/commit/7d79aa76e984da85f...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Gaynor in collaboration with Claude and Anthropic Research
.