CVE-2026-58061

A flaw was found in Bouncy Castle for Java. When using CCM-family (Counter with CBC-MAC) modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity impact if the plaintext is processed before the tag validation completes.

This flaw has an Important impact. Bouncy Castle for Java's CCM-family authenticated encryption modes (Counter with CBC-MAC) write decrypted plaintext to the caller's buffer before verifying the cryptographic tag. A remote attacker can exploit this by sending manipulated ciphertext, which will be decrypted and written to the buffer. If the application processes this buffer before the tag verification completes and fails, the attacker has successfully bypassed the integrity protection, allowing manipulation of data that the application assumes is authenticated. This affects applications using CCMBlockCipher, KCCMBlockCipher, or KGCMBlockCipher modes from the Bouncy Castle crypto provider.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.