CVE-2026-59640: Bouncy Castle Information Disclosure Bug

CVE-2026-59640 Overview

CVE-2026-59640 is a cryptographic side-channel vulnerability in the Bouncy Castle for Java cryptography library. The flaw resides in the OpenPGP Cipher Feedback (CFB) quick-check oracle, which remains active on symmetric and session-key decryption paths. An attacker who can submit crafted ciphertexts and observe error responses can exploit this observable discrepancy [CWE-203] to recover plaintext data through an adaptive chosen-ciphertext attack. The vulnerability affects Bouncy Castle for Java before 1.85, Bouncy Castle for Java LTS before 2.73.12, and multiple releases of the FIPS-certified Bouncy Castle for Java (BC-FJA).

Critical Impact
Attackers with network access and no authentication can exploit the CFB quick-check oracle to compromise the confidentiality of OpenPGP-encrypted data.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA): bcpg-fips before 1.0.13, 2.0.13, and 2.1.13

Discovery Timeline

2026-08-03 - CVE-2026-59640 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-59640

Vulnerability Analysis

Bouncy Castle's OpenPGP implementation performs a CFB quick-check when processing Symmetrically Encrypted Integrity Protected Data (SEIPD) packets. This early plaintext validation returns distinguishable outcomes based on whether the first block decrypts to a recognizable structure. When applied to session-key and public-key decryption paths, this check leaks information about the plaintext to a remote attacker.

The issue is classified as an observable discrepancy [CWE-203]. It enables classic OpenPGP CFB oracle attacks similar to prior published research against PGP integrity mechanisms. An attacker who can trigger repeated decryption attempts against modified ciphertext can extract plaintext bytes one block at a time.

Root Cause

The root cause lies in processSymmetricEncIntegrityPacketDataStream within PGPEncryptedData.java. The function did not distinguish between the symmetric-key path and the public-key path when deciding whether to enforce the CFB quick-check. On the session-key/public-key path, the quick-check should be suppressed because integrity is later enforced by the SEIPD Modification Detection Code (MDC). Leaving the oracle active created a distinguishable failure signal before the MDC verification stage.

Attack Vector

Exploitation requires an attacker capable of submitting OpenPGP ciphertext to a vulnerable decryptor and observing error responses or timing. No authentication or user interaction is required. Automated services that decrypt attacker-supplied PGP payloads such as mail gateways, key servers, or API endpoints are the most exposed targets.

java

// Bouncy Castle patch: suppress CFB quick-check oracle on the
// OpenPGP session-key/public-key path
// File: pg/src/main/java/org/bouncycastle/openpgp/PGPEncryptedData.java
boolean processSymmetricEncIntegrityPacketDataStream(
        boolean withIntegrityPacket,
        PGPDataDecryptor dataDecryptor,
-       InputStream encIn)
+       InputStream encIn, boolean publicKeyEncrypted)
        throws IOException
{
    encStream = dataDecryptor.getInputStream(encIn);
    // ... quick-check now gated by publicKeyEncrypted flag
}

// File: pg/src/main/java/org/bouncycastle/openpgp/PGPPublicKeyEncryptedData.java
PGPDataDecryptor dataDecryptor = dataDecryptorFactory.createDataDecryptor(
        true, sessionKey.getAlgorithm(), sessionKey.getKey());
-processSymmetricEncIntegrityPacketDataStream(true, dataDecryptor, encIn);
+processSymmetricEncIntegrityPacketDataStream(true, dataDecryptor, encIn, true);
// Source: https://github.com/bcgit/bc-java/commit/6b94b1c146cec1f565d9a85847fae511af77503e

Detection Methods for CVE-2026-59640

Indicators of Compromise

Repeated OpenPGP decryption failures originating from the same client or IP address, indicating oracle probing.
Unusual volumes of malformed SEIPD packets submitted to mail gateways, PGP-decrypting APIs, or key management services.
Java applications loading vulnerable bcpg, bcprov, or bcpg-fips artifacts below the patched versions.

Detection Strategies

Inventory Java dependencies using Software Bill of Materials (SBOM) tooling to identify vulnerable Bouncy Castle versions.
Instrument OpenPGP decryption endpoints to log and rate-limit repeated failures per source identity.
Monitor application logs for high-frequency PGPException or IOException events tied to SEIPD processing.

Monitoring Recommendations

Alert on anomalous rates of PGP decryption errors that could indicate an adaptive chosen-ciphertext probe.
Track outbound TLS and API traffic from PGP-processing services for unexpected exfiltration following decryption anomalies.
Correlate decryption failures with authentication events to detect scripted oracle abuse.

How to Mitigate CVE-2026-59640

Immediate Actions Required

Upgrade to Bouncy Castle for Java 1.85 or later, or Bouncy Castle for Java LTS 2.73.12 or later.
Upgrade Bouncy Castle for Java FIPS to bcpg-fips 1.0.13, 2.0.13, or 2.1.13 depending on the deployed series.
Audit all Java services that decrypt attacker-influenced OpenPGP data and prioritize them for patching.

Patch Information

The fix suppresses the CFB quick-check oracle on the OpenPGP session-key and public-key decryption paths. See the upstream commit at bcgit/bc-java commit 6b94b1c and the vendor advisory at Bouncy Castle CVE-2026-59640 wiki.

Workarounds

Where patching is delayed, restrict PGP decryption endpoints to authenticated internal clients only.
Apply strict rate limiting and account lockouts on repeated decryption failures to raise the cost of oracle probing.
Normalize error responses returned by PGP-processing services so distinct failure modes cannot be distinguished by external callers.

bash

# Update Bouncy Castle dependencies in a Maven project
mvn versions:use-dep-version -Dincludes=org.bouncycastle:bcpg-jdk18on -DdepVersion=1.85
mvn versions:use-dep-version -Dincludes=org.bouncycastle:bcprov-jdk18on -DdepVersion=1.85

# For FIPS deployments
mvn versions:use-dep-version -Dincludes=org.bouncycastle:bcpg-fips -DdepVersion=2.1.13

# Verify no vulnerable versions remain on the classpath
mvn dependency:tree | grep -Ei 'bcpg|bcprov|bc-fips'