CVE-2026-103601 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders and developers using the Bouncy Castle Inc. bc-csharp library should assess exposure and apply patches. Roles include security teams, developers, and system administrators responsible for cryptographic applications.

Why it matters

This vulnerability in the Bouncy Castle Inc. bc-csharp library allows remote attackers to obtain decryptions via forged messages, impacting applications using affected versions. Defenders should assess exposure, apply patches, and verify decryption processes to prevent plaintext exposure.

• Remote attackers can obtain decryptions of ciphertexts via forged messages
• Applications using affected library versions may expose decrypted plaintext
• Decryption processes may reveal sensitive information
• Verification of decryption processes is necessary to prevent plaintext exposure

Technical summary

The Bouncy Castle Inc. bc-csharp library before version 2.7.0 has a vulnerability in the CCM and DSTU 7624 CCM AEAD modes. This allows remote attackers to obtain decryptions of ciphertexts via forged messages sent to applications that allow observation of the output buffer of a failed decryption. The vulnerability affects decryption into a caller-supplied buffer. Methods that return a newly allocated array are not affected. Official patches are available for version 2.7.0 or later. Defenders should assess exposure and apply patches.

Defensive priority

High

Recommended defensive actions

• Review and apply patches for bc-csharp library version 2.7.0 or later
• Assess exposure of applications using affected versions of the library
• Verify decryption processes to prevent plaintext exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported in the Bouncy Castle Inc. bc-csharp library before version 2.7.0. Official patches are available. Evidence is limited to public CVE and NVD records. Defenders should verify decryption processes to prevent plaintext exposure and review patches for bc-csharp library version 2.7.0 or later. The vulnerability allows remote attackers to obtain decryptions of ciphertexts via forged messages sent to applications that allow observation of the output buffer of a failed decryption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.