CVE-2026-71888 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for systems using Bouncy Castle for Java, particularly those using versions before 1.86, should assess exposure and prioritize verification and remediation efforts.

Why it matters

Defenders should prioritize verifying and updating Bouncy Castle for Java to a secure version, assessing exposure in systems using affected versions, and implementing compensating controls to detect and prevent unauthorized attribute insertion.

• Potential insertion of authenticated attributes by an attacker
• Possible unauthorized authorization, routing, or labelling decisions
• Need for verification and updating of Bouncy Castle for Java
• Potential impact on systems using affected versions

Technical summary

The streaming CMS AuthenticatedData parser in Bouncy Castle for Java before 1.86 incorrectly handled messages with mismatched digestAlgorithm and authAttrs fields, potentially allowing an attacker to insert authenticated attributes into a message. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series). The vulnerability allows for potential insertion of authenticated attributes by an attacker, and defenders should prioritize verifying and updating Bouncy Castle for Java to a secure version.

Defensive priority

Defenders should prioritize verifying and updating Bouncy Castle for Java to a secure version, assessing exposure in systems using affected versions, and implementing compensating controls to detect and prevent unauthorized attribute insertion.

Recommended defensive actions

• Verify and update Bouncy Castle for Java to a secure version
• Assess exposure in systems using affected versions
• Implement compensating controls to detect and prevent unauthorized attribute insertion
• Monitor for suspicious activity related to authenticated attribute insertion
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Bouncy Castle for Java, including the affected versions and potential impacts. However, further verification is needed to determine the full scope of exposure and required remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.