CVE-2026-63567 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for systems using the bc-csharp library, especially those handling cryptographic operations, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-63567 is a high-severity vulnerability in the Bouncy Castle Inc.'s bc-csharp library that allows remote attackers to recover plaintext from captured ciphertexts via a CBC padding-oracle attack. Defenders should prioritize verifying exposure in systems using the affected library and implement remediation efforts to prevent unauthorized access to sensitive information.

• Remote attackers can exploit this vulnerability to recover plaintext from captured ciphertexts.
• Successful exploitation can lead to unauthorized access to sensitive information.
• Defenders need to verify exposure in systems using the affected library and prioritize remediation.
• Remediation involves updating to version 2.7.0 or later and implementing compensating controls.

Technical summary

The IesEngine.DecryptBlock function in the Bouncy Castle Inc.'s bc-csharp library before version 2.7.0 is vulnerable to a CBC padding-oracle attack. This allows a remote attacker who has captured an IES or ECIES ciphertext and can submit modified ciphertexts for decryption under the same key pair to recover its plaintext. The vulnerability arises because in block-cipher mode the engine decrypts the ciphertext and removes its padding before verifying the MAC. A padding failure is therefore reported with a different error message, and without the MAC computation, compared with a MAC failure. Only applications that construct IesEngine directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding

Defensive priority

Defenders should prioritize verifying exposure in systems using the affected bc-csharp library, especially those handling cryptographic operations. Immediate actions include updating to version 2.7.0 or later and implementing compensating controls to monitor and restrict suspicious decryption attempts.

Recommended defensive actions

• Update bc-csharp to version 2.7.0 or later
• Implement compensating controls to monitor and restrict suspicious decryption attempts
• Verify exposure in systems using the affected library
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and affected versions. Patches are available in the bc-csharp repository. A remote attacker who has captured an IES or ECIES ciphertext and can submit modified ciphertexts for decryption under the same key pair can recover its plaintext via a CBC padding-oracle attack. The attack exploits a CBC padding-oracle vulnerability, which arises because the engine decrypts the ciphertext, removes its padding, and reports padding failures with a different error.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.