CVE-2026-63569 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Cryptographers, security engineers, and developers using bc-csharp for Diffie-Hellman key exchanges should assess exposure and apply patches or compensating controls. Affected operators and platforms require immediate attention to prevent potential key authentication bypass and private key recovery.

Why it matters

CVE-2026-63569 is a critical vulnerability in bc-csharp before 2.7.0 that allows on-path attackers to bypass key authentication in Diffie-Hellman key exchanges and potentially recover private keys. Developers and cryptographers using bc-csharp should immediately assess exposure and apply patches or compensating controls.

• Key authentication can be defeated, allowing on-path attackers to impersonate parties
• Local static private keys may be recoverable, especially in groups with many small factors of p-1
• Verification of peer ephemeral values is crucial to prevent these attacks
• Remediation priority is high due to potential for private key compromise

Technical summary

The vulnerability exists in the DHAgreement.CalculateAgreement function in bc-csharp before 2.7.0. An on-path attacker can manipulate ephemeral values to bypass key authentication and potentially recover the local static private key. This is due to insufficient range and subgroup-membership checks on the crafted values. The attack allows on-path attackers to defeat key authentication MTI/A0 is meant to provide and to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from the vendor for bc-csharp version 2.7.0 or later
• Inventory applications using DHAgreement directly and assess exposure
• Implement compensating controls for on-path attacks
• Monitor for suspicious activity related to Diffie-Hellman key exchanges
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE and NVD records provide details on the vulnerability in bc-csharp before 2.7.0. Vendor patches are available but specific version details are not provided in the corpus. The attack uses a crafted out-of-range or small-order ephemeral value and works because that value is raised to the static private key without the range and subgroup-membership checks applied to DH public keys. Evidence is limited to CVE and NVD records; further verification is needed to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.