CVE-2026-71884: Bouncy Castle Java LTS Information Disclosure

CVE-2026-71884 Overview

CVE-2026-71884 affects Bouncy Castle for Java LTS before version 2.73.13. The native one-shot Counter (CTR) mode packet cipher fails to validate that the requested input length fits within the counter space left by the Initialization Vector (IV). When an IV consumes 13 to 15 bytes of the 16-byte block, only 1 to 3 bytes remain for the counter, limiting addressable blocks to 256, 65536, or 16777216 respectively. Supplying longer input causes the counter to wrap, which repeats the keystream within the same packet. The call returns the full input length as if encryption succeeded, giving no signal of the failure. This is a cryptographic weakness tracked under [CWE-323: Reusing a Nonce, Key Pair in Encryption].

Critical Impact
Keystream reuse within a single packet allows plaintext recovery from ciphertext alone, without knowledge of the key, while callers receive a successful return value.

Affected Products

Bouncy Castle for Java LTS versions before 2.73.13
Native one-shot CTR packet cipher code path
Applications relying on the native implementation with IVs of 13 to 15 bytes

Discovery Timeline

2026-10-09 - CVE-2026-71884 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-71884

Vulnerability Analysis

CTR mode constructs each block of keystream by encrypting the concatenation of an IV and a block counter inside a single 16-byte block. The counter width therefore equals 16 bytes minus the IV length. For a 13-byte IV, the counter holds 3 bytes and can address only 16777216 blocks before wrapping. For a 15-byte IV, the counter holds a single byte and wraps after 256 blocks.

The native one-shot path in Bouncy Castle for Java LTS performed no counter-range validation at its single entry point. When the input length exceeded the counter space, the counter wrapped and the cipher reused the keystream from the start of the packet. Two segments of the message were then XORed against the same keystream. An attacker holding the ciphertext can XOR the overlapping segments to cancel the keystream and recover plaintext relationships, without recovering the key itself.

Root Cause

The root cause is missing precondition enforcement in a single-entry native code path. The streaming implementation validates counter range at initialization and during processing, and the portable AESCTRPacketCipher rejects out-of-range requests with the error Counter in CTR/SIC mode out of range. The native one-shot path omitted equivalent checks and reported success for bytes it did not correctly transform.

Attack Vector

Exploitation requires an attacker to observe ciphertext produced by a vulnerable caller using an IV of 13, 14, or 15 bytes together with plaintext longer than the counter can address. The attacker does not need network interactivity with the victim beyond ciphertext capture. Classic two-time pad analysis against the overlapping ciphertext regions yields plaintext recovery. A full 16-byte IV, or any IV leaving a counter of four bytes or more, is unaffected because a Java int length cannot exhaust that counter range. The pure Java provider bcprov ships no native implementations and is not affected.

See the Bouncy Castle advisory for CVE-2026-71884 for the maintainers' technical write-up.

Detection Methods for CVE-2026-71884

Indicators of Compromise

Deployed bc-lts-java artifacts with version lower than 2.73.13 on the classpath or in dependency manifests.
Application telemetry showing successful one-shot CTR encrypt or decrypt calls with IV lengths of 13, 14, or 15 bytes.
Ciphertexts of unusual length produced with short-counter configurations, which are candidates for offline keystream-reuse analysis.

Detection Strategies

Perform software composition analysis across build pipelines to flag any Bouncy Castle LTS release prior to 2.73.13.
Add static analysis rules that identify callers of the native one-shot CTR packet cipher with non-16-byte IVs.
Review cryptographic audit logs for CTR operations where input length approaches or exceeds the counter capacity implied by the IV length.

Monitoring Recommendations

Monitor dependency updates and container image rebuilds for continued presence of vulnerable bc-lts-java versions.
Alert on application errors referencing Counter in CTR/SIC mode out of range. after patching, which indicates callers now hitting the new preflight check.
Track outbound data flows from services that persisted ciphertexts produced during the vulnerable window for post-incident re-encryption.

How to Mitigate CVE-2026-71884

Immediate Actions Required

Upgrade Bouncy Castle for Java LTS to version 2.73.13 or later across all applications and container images.
Inventory all cryptographic call sites that use CTR mode with IVs shorter than 16 bytes and audit their input length assumptions.
Treat any ciphertext produced by the vulnerable native one-shot path with short counters as potentially compromised and plan re-encryption with a fresh key.

Patch Information

The fix in Bouncy Castle for Java LTS 2.73.13 adds a preflight check in the native one-shot CTR packet cipher. It derives the counter range from the IV length and rejects requests that would wrap the counter before any output is written. The operation is now failure-atomic and never reports success for untransformed bytes. Refer to the Bouncy Castle project advisory for release details.

Workarounds

Use a full 16-byte IV where counter management is the caller's responsibility, which bypasses the affected code path.
Switch affected call sites to the portable AESCTRPacketCipher, which already rejects out-of-range counter requests.
Constrain application-layer logic to enforce input length limits consistent with the counter space left by the chosen IV length.

bash

# Configuration example: update Maven dependency to the fixed release
# <dependency>
#   <groupId>org.bouncycastle</groupId>
#   <artifactId>bc-lts-java</artifactId>
#   <version>2.73.13</version>
# </dependency>
mvn versions:set-property -Dproperty=bc-lts.version -DnewVersion=2.73.13
mvn dependency:tree | grep bc-lts-java