CVE-2026-12803

Katalog CVE

CVSS 7.5 · High EPSS 0,20%

Kerentanan Improper Validation of Integrity Check Value pada bouncycastle bc-java, bouncycastle bouncy castle for java lts. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

2 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bcgit/bc-java/commit/697794413ebf7bc5e3fce609a707826ba52981af patch
• https://github.com/bcgit/bc-java/commit/7d79aa76e984da85f2a541cae8ba2ae56e1713bc patch
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012803 advisory pihak ketiga · patch