Vulnerability in Bouncy Castle for Java LTS Affects Packet Cipher Implementation

CVE-2026-71884

What is CVE-2026-71884?

The Bouncy Castle for Java LTS has a vulnerability in its native one-shot CTR packet cipher where length validation for input requests was not performed. This issue arises because the cipher does not ensure that the input length is suitable for the available counter space determined by the Initialization Vector (IV). If the IV is under certain lengths, it leaves insufficient counter space, causing the keystream to repeat for longer messages. This vulnerability allows for the recovery of plaintext from ciphertext without requiring the key. The implementation was corrected to prevent such requests from being processed, ensuring that no erroneous outputs are reported for lengths exceeding the acceptable counter range.

References