Anthropics

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Improper validation of the integrity check value in the AES-CCM implementation, specifically within `CcmParameters` and `CcmBlockCipher`, allows an on-path attacker to modify CCM-encrypted content without detection. This occurs because `CcmParameters` accepts any value for the authentication tag (`aes-ICVlen`), and `CcmBlockCipher` only validates the tag length during encryption. Consequently, decryption may compare a zero-length or excessively short tag. Affected paths include `ParameterUtilities.GetCipherParameters`, which is utilized by `CmsEnvelopedData` and `CmsEnvelopedDataParser` for EnvelopedData encrypted with AES-CCM, as well as any caller providing an unchecked tag length to `CcmBlockCipher` for decryption. **Recommendations** Update to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** A cryptographic flaw exists in the DSTU 7624 CCM mode implementation within the `KCcmBlockCipher` function. The issue occurs when messages are encrypted without associated data, as the G1 block—which binds the nonce, message length, and parameter flags into the CBC-MAC (Cipher Block Chaining Message Authentication Code)—is only processed when associated data is present. Consequently, the authentication tag becomes a CBC-MAC of the plaintext alone and remains independent of the nonce. This allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags. Only applications that use `KCcmBlockCipher` directly and provide no associated data are affected. **Recommendations** Update bc-csharp to version 2.7.0 or later. As a temporary mitigation, avoid using the `KCcmBlockCipher` function without providing associated data.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** In the stream mode of `IesEngine` (when constructed without a block cipher), the message authentication key is exposed through the encryption keystream. A remote attacker who has observed one encrypted message with known plaintext can forge shorter messages that the recipient accepts as authentic by using a crafted ciphertext and MAC tag. This occurs because the MAC key is derived from the output directly after a keystream as long as the message, while the derivation input depends only on the static key pair and fixed parameters. Consequently, the keystream revealed by a single message contains the MAC key for all sufficiently shorter messages. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** An issue exists in the DTLS handshake reassembly process within `DtlsReliableHandshake` and `DtlsReassembler`. A remote unauthenticated DTLS peer can trigger a denial of service through memory exhaustion by sending crafted handshake message fragments. This occurs because the reassembly buffer for incoming handshake messages is allocated based on the 24-bit length declared in the fragment header without verifying it against the peer's maximum handshake message size. Consequently, a fragment with no payload can force an allocation of nearly 16 MB for each of the 16 pending messages per handshake before authentication. Both DTLS servers and clients are affected, while TLS remains unaffected. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** A discrepancy in the `DecryptBlock()` function of the `IesEngine` allows a remote attacker to recover plaintext from captured IES or ECIES ciphertexts. This occurs when an attacker submits modified ciphertexts for decryption using the same key pair, enabling a CBC padding-oracle attack. In block-cipher mode, the engine decrypts the ciphertext and removes padding before verifying the Message Authentication Code (MAC). Consequently, the system returns different error messages for padding failures versus MAC failures. This issue specifically affects applications that construct `IesEngine` directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding; stream-mode IES is not affected. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Resource allocation without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion. This occurs when a CMP message or CRMF certificate request contains a `PBMParameter` with an excessively large iteration count. The issue exists because the `PKMacBuilder` only enforces an iteration-count ceiling when an explicit maximum is provided via the `PKMacBuilder(IPKMacPrimitivesProvider, int)` constructor. When other constructors are used, the `ProtectedPkiMessage.Verify` and `CertificateRequestMessage.IsValidSigningKeyPop` functions perform up to 2^31 hash iterations as requested by the sender before the MAC is verified. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Improper input validation in the `CalculateAgreement()` function of the `DHAgreement` class (MTI/A0 two-pass Diffie-Hellman) allows an on-path attacker to force the local party to compute an agreed value already known to the attacker, bypassing the key authentication provided by MTI/A0. Additionally, a malicious peer can learn the local static private key modulo the small factors of p-1, potentially recovering the key entirely in groups with many such factors. This occurs because crafted out-of-range or small-order ephemeral values are raised to the static private key without the necessary range and subgroup-membership checks typically applied to DH public keys. Only applications that call `DHAgreement` directly are affected. **Recommendations** Update bc-csharp to version 2.7.0 or later. As a temporary mitigation, restrict the direct use of the `DHAgreement` class until the update is applied.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** The CCM (`CcmBlockCipher`) and DSTU 7624 CCM (`KCcmBlockCipher`) AEAD modes release unverified plaintext. A remote attacker can obtain decryptions of chosen ciphertexts by sending forged messages to an application that allows the output buffer of a failed decryption to be observed, such as through logging or buffer reuse. This occurs because the decryption process writes the recovered plaintext into the caller-supplied output buffer before verifying the authentication tag and fails to clear it if the check fails. This issue only affects decryption into a caller-supplied buffer; methods returning a newly allocated array are not impacted. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Improper certificate validation occurs in the `PkixNameConstraintValidator` function. An attacker controlling a name-constrained intermediate CA can cause certificates to be accepted during PKIX certification path validation for email addresses, DNS names, or URI hosts that should be excluded. This happens because the system compares names and constraints without removing the RFC 1034 root-label trailing dot, allowing a fully qualified host name to bypass an excluded subtree match. This flaw affects trust controls used in digital identity, government, and financial systems. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Remote unauthenticated attackers can cause a denial of service through memory exhaustion by providing a specially crafted HSS public key and signature. The issue occurs because the level count `L` read during the parsing of an HSS public key in the `HssPublicKeyParameters` and `HssSignature` code is not validated against the RFC 8554 maximum limit of 8. Consequently, the signature parsing process allocates an array of `L - 1` entries before processing further data, which can lead to a single verification committing up to 17 GB of memory or triggering an `OutOfMemoryException`. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Inefficient algorithmic complexity in X.509 distinguished name string conversion within the `X509Name.ToString` and `IetfUtilities.ValueToString` functions allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion. This occurs when processing a certificate, CRL, certification request, or other structure containing a long attribute value composed of leading or trailing spaces or characters that require escaping, such as commas. The issue arises because each escaping backslash is inserted into the buffer being scanned, causing the workload to grow quadratically relative to the value length. Applications are susceptible when converting such names to strings for logging or display, or when comparing them using the `IetfUtilities.RdnAreEqual` function, as seen in PKIX path validation for `directoryName` name constraints. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** A denial of service occurs in the `Pkcs12Store.GetCertificateChain()` function when an application loads a crafted PKCS#12 file and requests a key entry's certificate chain. An attacker can trigger this by providing certificates whose issuer links form a cycle, such as two certificates where the AuthorityKeyIdentifier extensions identify each other's public key. The issue arises because the chain-building loop only terminates when no issuer is found or a certificate links to itself, failing to track previously visited certificates and following key-identifier links without verifying signatures. This results in an infinite loop that consumes CPU and memory until an OutOfMemoryException is triggered. **Recommendations** Update to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Improper verification of cryptographic signatures in the attribute certificate path validator `PkixAttrCertPathValidator` (also used by `PkixAttrCertPathBuilder`) allows a remote attacker to have a forged X.509 attribute certificate accepted as valid. This occurs because the RFC 3281 validation steps verify the holder and issuer certification paths, validity period, extensions, and revocation status, but fail to verify the attribute certificate's signature using the issuer's public key. An attacker can exploit this by using an attribute certificate that names a trusted attribute authority as its issuer without actually being signed by it, potentially gaining roles or privileges granted by the application based on those attributes. Only applications utilizing these specific classes to validate attribute certificates are affected. **Recommendations** Update bc-csharp to version 2.7.0 or later. As a temporary mitigation, restrict the use of the `PkixAttrCertPathValidator` and `PkixAttrCertPathBuilder` classes for validating attribute certificates.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** A discrepancy exists in the CMS RSA PKCS#1 v1.5 key-transport unwrap process within the `KeyTransRecipientInformation.UnwrapKey` function. A remote attacker with a captured CMS EnvelopedData message can recover the content-encryption key and the message content by submitting multiple modified messages to an application. This is possible through a Bleichenbacher-style adaptive chosen-ciphertext attack, where the application reveals decryption failure details. Specifically, ciphertexts with invalid PKCS#1 v1.5 padding trigger a distinct `CmsException` stating "bad padding in message" during the unwrap process, rather than being replaced by a random key. This allows the attacker to distinguish between incorrectly padded ciphertexts and those that are correctly padded but fail during subsequent content decryption. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Remote, unauthenticated attackers can cause a denial of service through memory exhaustion or an `OutOfMemoryException` by providing a specially crafted OpenPGP public key, certificate, or signature. The issue exists in the `SignatureSubpacketsParser.ReadPacket` and `UserAttributeSubpacketsParser.ReadPacket` functions. It occurs when a subpacket header uses the five-octet length form, as the declared length is used to size the subpacket buffer without an upper bound or comparison to the size of the enclosing packet. Consequently, a small amount of input can trigger a memory allocation of approximately 2 GB before any data is actually read. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Improper certificate validation occurs in the `PkixNameConstraintValidator` (specifically within the `ExtractHostFromURL` function). This issue allows a name-constrained subordinate CA, or an entity capable of obtaining certificates with chosen `subjectAltName` URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation. The flaw exists because the host is extracted using string slicing without first isolating the RFC 3986 authority component. Consequently, if a URI's path, query, fragment, or userinfo contains characters such as '@' or ':', the host compared against the constraints may differ from the actual host of the URI. **Recommendations** Update bc-csharp to version 2.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** bc-csharp versions prior to 2.7.0 **Description** Improper certificate validation occurs during the directoryName name-constraint check within the `PkixNameConstraintValidator.WithinDNSubtree` function. An attacker controlling a name-constrained intermediate CA can bypass PKIX path validation by using a name that places other Relative Distinguished Names (RDNs) before a copy of the permitted RDN sequence. This happens because the validation process searches for the constraint's first RDN anywhere in the name and compares subsequent RDNs from that point, rather than ensuring the constraint is an initial prefix of the name as required by RFC 5280. **Recommendations** Update to version 2.7.0 or later.

Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS#8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVATE KEY" PEM file, to cause a denial of service through CPU exhaustion via an iteration count close to 2^31, because the count is taken from the unauthenticated algorithm parameters without an upper bound and the key derivation runs before the password or the data can be checked. PKCS#5 PBES1 and PBES2 (PBKDF2), the PKCS#12 PBE algorithms and CMS password recipients (CmsPbeKey) are affected. Loading PKCS#12 files with Pkcs12Store is covered by CVE-2026-63572, and a zero or negative count with the PKCS#12 algorithms by CVE-2026-63575.