CVE-2026-12802: Bouncy Castle Privilege Escalation Flaw

CVE-2026-12802 Overview

CVE-2026-12802 affects the Bouncy Castle cryptographic library for Java. The vulnerability resides in the Cryptographic Message Syntax (CMS) AuthEnvelopedData implementation, which fails to enforce authentication tag length during decryption. This flaw allows an attacker to influence integrity checks on authenticated encrypted messages without triggering validation failures. The issue affects Bouncy Castle for Java before 1.85, Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions 1.0.X before 1.0.12, 2.0.X before 2.0.12, and 2.1.X before 2.1.12. The weakness is classified as [CWE-354] Improper Validation of Integrity Check Value.

Critical Impact
Attackers can bypass authenticated encryption integrity checks in CMS AuthEnvelopedData messages, compromising message integrity guarantees relied upon by downstream applications.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (bcpkix-fips) 1.0.X before 1.0.12, 2.0.X before 2.0.12, 2.1.X before 2.1.12

Discovery Timeline

2026-08-03 - CVE-2026-12802 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-12802

Vulnerability Analysis

The vulnerability affects the CMS AuthEnvelopedData content type defined in RFC 5083. This structure combines authenticated encryption with associated data (AEAD) semantics with the CMS envelope format. During decryption, Bouncy Castle does not validate the length of the authentication tag against expected values for the negotiated algorithm. An attacker able to craft or modify CMS messages can influence how the tag is processed, weakening the integrity guarantee that AuthEnvelopedData is designed to provide. The vulnerability affects only integrity, not confidentiality or availability, according to the published CVSS metrics.

Root Cause

The root cause is missing enforcement of the AEAD authentication tag length on the decryption path. Standards such as GCM allow multiple tag lengths, and secure implementations must reject tags shorter than the expected length for the ciphersuite. Bouncy Castle omitted this check for CMS AuthEnvelopedData, allowing truncated or malformed tag lengths to pass verification stages that should have rejected them. This is a classic instance of [CWE-354] Improper Validation of Integrity Check Value.

Attack Vector

The vulnerability is network-reachable and requires no authentication or user interaction. An attacker who can deliver or tamper with CMS AuthEnvelopedData messages processed by an application built on the affected Bouncy Castle versions can undermine the integrity of authenticated ciphertext. This is relevant wherever CMS is used for secure messaging, signed and encrypted email, or authenticated document exchange. Refer to the Bouncy Castle CVE-2026-12802 Wiki entry and the upstream fix commit for technical details of the corrective changes.

Detection Methods for CVE-2026-12802

Indicators of Compromise

CMS AuthEnvelopedData payloads containing shorter-than-expected AEAD authentication tags accepted by the parser.
Application logs showing successful decryption of AuthEnvelopedData messages that originated from untrusted sources without integrity errors.
Presence of vulnerable Bouncy Castle artifacts (bcprov-jdk*, bcpkix-jdk*, bcpkix-fips) in application dependency manifests.

Detection Strategies

Perform Software Composition Analysis (SCA) across build pipelines and deployed artifacts to identify Bouncy Castle versions below the patched thresholds.
Scan container images and Java classpaths for vulnerable bcprov and bcpkix JAR versions.
Instrument CMS decryption code paths to log the algorithm and tag length used, then alert on non-standard tag lengths.

Monitoring Recommendations

Monitor dependency inventories continuously for the fixed versions: 1.85, 2.73.12, bcpkix-fips 1.0.12, 2.0.12, and 2.1.12.
Track processing of inbound CMS messages, particularly from external partners, and alert when integrity anomalies are observed.
Correlate application telemetry with vulnerability management data to prioritize hosts running services that consume CMS AuthEnvelopedData.

How to Mitigate CVE-2026-12802

Immediate Actions Required

Upgrade Bouncy Castle for Java to 1.85 or later, or Bouncy Castle for Java LTS to 2.73.12 or later.
Upgrade Bouncy Castle FIPS (bcpkix-fips) to 1.0.12, 2.0.12, or 2.1.12 depending on the deployed series.
Rebuild and redeploy applications that shade or repackage Bouncy Castle to ensure the fixed classes are in effect.
Audit trust boundaries where CMS AuthEnvelopedData messages are accepted from external sources.

Patch Information

The fix is implemented in the Bouncy Castle repository via commit 0fefa539e6ac5c66e1daee5a13b23d1d4769cc01, which adds enforcement of the expected authentication tag length during AuthEnvelopedData decryption. Additional context is documented in the CVE-2026-12802 wiki page.

Workarounds

If immediate upgrade is not possible, restrict CMS AuthEnvelopedData processing to trusted senders using transport-layer authentication and network controls.
Validate authentication tag length in application code before passing ciphertext to the Bouncy Castle CMS API.
Prefer alternative CMS content types with well-established integrity handling where feasible until patched versions are deployed.

bash

# Verify installed Bouncy Castle versions in a Maven project
mvn dependency:tree | grep -Ei 'bcprov|bcpkix'

# Example Maven upgrade to fixed versions
# <dependency>
#   <groupId>org.bouncycastle</groupId>
#   <artifactId>bcpkix-jdk18on</artifactId>
#   <version>1.85</version>
# </dependency>