CVE-2026-12817: Bouncy Castle Java AEAD Decryption Flaw

CVE-2026-12817 Overview

CVE-2026-12817 is a high-severity integrity flaw in Bouncy Castle for Java. The vulnerability affects OpenPGP AEAD decryption in BcAEADUtil and JceAEADUtil, where the decrypting stream skips verification of the final message authentication tag when plaintext is an exact multiple of chunkLength. An attacker who can tamper with ciphertext can strip trailing chunks plus the final tag and have the recipient accept truncated plaintext as authentic. The issue is classified under [CWE-354] Improper Validation of Integrity Check Value.

Critical Impact
Attackers can truncate OpenPGP AEAD-encrypted messages at chunk boundaries without detection, breaking the integrity guarantees of SEIPDv2 (OpenPGP v6) and the v5 AEAD packet defined by RFC 9580.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA): bcpg-fips before 1.0.13 (1.0.X), 2.0.13 (2.0.X), and 2.1.13 (2.1.X)

Discovery Timeline

2026-08-03 - CVE-2026-12817 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-12817

Vulnerability Analysis

RFC 9580 section 5.13.2 requires an OpenPGP AEAD message to end with a final authentication tag. This tag authenticates the total plaintext length so truncation at a chunk boundary is detectable. Bouncy Castle's decrypting stream in BcAEADUtil and JceAEADUtil verified that final tag only when the last data chunk was shorter than chunkLength.

When plaintext length was an exact multiple of chunkLength, every chunk was full-size. The final tag was pre-read into the look-ahead buffer but never passed to doFinal, and the stream returned a clean EOF without checking it. Because PGPEncryptedData.verify() returns true unconditionally for AEAD, no backstop existed to catch the missing verification.

The flaw affects SEIPDv2 (OpenPGP v6) and the v5 AEAD packet format. Surviving chunks remained individually authenticated, so only truncation at exact chunk boundaries was exploitable.

Root Cause

The defect is an Improper Validation of Integrity Check Value [CWE-354]. The stream decoder used chunk-length comparison as the trigger for final-tag verification instead of always verifying at EOF. Chunk-aligned messages produced no short final chunk, so the code path that invoked tag verification was never reached.

Attack Vector

An attacker with the ability to modify AEAD ciphertext in transit or at rest can strip trailing full-size chunks along with the final message tag. After fixing up the unauthenticated outer packet length, the truncated message decrypts cleanly and PGPEncryptedData.verify() reports success. No key material or network privileges beyond ciphertext access are required.

java

// Patch excerpt from BcAEADUtil.java
private int dataOff;
private long chunkIndex = 0;
private long totalBytes = 0;
private boolean aeadComplete = false; // set once the trailing message tag has been verified
private final boolean isV5StyleAEAD;

Source: Bouncy Castle GitHub commit 4b71281

Detection Methods for CVE-2026-12817

Indicators of Compromise

OpenPGP AEAD-encrypted messages with outer packet lengths inconsistent with expected sender behavior or historical baselines.
Application logs showing successful PGPEncryptedData.verify() results paired with unexpectedly short decrypted payloads.
Java applications loading vulnerable bcpg, bcpg-lts, or bcpg-fips JAR versions below the fixed releases.

Detection Strategies

Inventory Java dependencies across build systems and running JVMs to identify vulnerable Bouncy Castle versions.
Enable software composition analysis (SCA) in CI/CD to fail builds pulling bcpg below 1.85, bcpg-lts below 2.73.12, or bcpg-fips below the fixed 1.0.13 / 2.0.13 / 2.1.13 releases.
Compare decrypted plaintext lengths to expected message sizes for automated OpenPGP workflows and alert on anomalies.

Monitoring Recommendations

Log the byte count returned from OpenPGP AEAD decryption calls and correlate against sender-declared metadata.
Monitor process-level use of Bouncy Castle classes such as BcAEADUtil and JceAEADUtil in application telemetry.
Track upstream advisories at the Bouncy Castle CVE-2026-12817 wiki for updated guidance.

How to Mitigate CVE-2026-12817

Immediate Actions Required

Upgrade Bouncy Castle for Java to 1.85 or later on all affected systems.
Upgrade Bouncy Castle for Java LTS to 2.73.12 or later where the LTS distribution is in use.
Upgrade bcpg-fips to 1.0.13, 2.0.13, or 2.1.13 depending on the FIPS series deployed.
Re-verify the integrity of any AEAD-decrypted OpenPGP payloads received before patching, especially high-value messages.

Patch Information

The upstream fix is committed in the Bouncy Castle Java repository. The decrypting stream now always verifies the final message tag before signalling EOF, using an aeadComplete flag in both the Bc and Jce decryptors. Review the fix at the Bouncy Castle GitHub commit.

Workarounds

If patching is not immediately possible, avoid processing untrusted OpenPGP AEAD (SEIPDv2 / v5) ciphertexts with vulnerable Bouncy Castle versions.
Prefer OpenPGP SEIPDv1 (MDC-protected) messages until upgrades are deployed, since the flaw is specific to the AEAD packet decoders.
Enforce out-of-band size or content checks on decrypted plaintext where an OpenPGP AEAD workflow cannot be paused.

bash

# Maven dependency example after upgrade
mvn dependency:tree | grep -E 'bcpg|bcpg-fips'
# Ensure versions are: bcpg >= 1.85, bcpg-lts >= 2.73.12,
# or bcpg-fips >= 1.0.13 / 2.0.13 / 2.1.13