CVE-2026-16000 Bouncycastle CVE debrief

Who should care

Defenders responsible for applications using KCcmBlockCipher directly without associated data should assess exposure and prioritize verification and patching. This includes reviewing the current implementation of KCcmBlockCipher in their systems, understanding the potential impact of ciphertext forgery attacks, and taking appropriate measures to mitigate these risks. Additionally, security teams and vulnerability management teams should be aware of the of

Why it matters

Defenders should care about CVE-2026-16000 because it allows ciphertext forgery attacks in applications using KCcmBlockCipher directly without associated data, impacting confidentiality and integrity.

• Potential ciphertext forgery attacks without associated data
• Verification of application exposure to KCcmBlockCipher without associated data
• Prioritization of patching or updating bc-csharp to version 2.7.0 or later

Technical summary

The KCcmBlockCipher in bc-csharp before 2.7.0 does not properly bind the nonce, message length, and parameter flags into the CBC-MAC when no associated data is present. This oversight allows an attacker to forge ciphertexts with valid authentication tags, as the tag becomes a CBC-MAC of the plaintext alone, independent of the nonce. Only applications directly using KCcmBlockCipher without associated data are affected, potentially impacting confidentiality and integrity through ciphertext forgery attacks. Defenders should prioritize verifying if their applications use KCcmBlockCipher directly and supply no associated data.

Defensive priority

Defenders should prioritize verifying if their applications use KCcmBlockCipher directly and supply no associated data, and assess exposure to potential ciphertext forgery attacks.

Recommended defensive actions

• Verify if applications use KCcmBlockCipher directly and supply no associated data
• Assess exposure to potential ciphertext forgery attacks
• Apply patches or updates to bc-csharp version 2.7.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0. This step is crucial as it binds the nonce, the message length, and the parameter flags into the CBC-MAC, which was only processed when associated data was present. Without associated data, the tag was a CBC-MAC of the plaintext alone, independent of the nonce. The issue specifically affects applications that use KCcmBlockCipher directly and supply no data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.