CVE-2026-16000

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description A cryptographic flaw exists in the DSTU 7624 CCM mode implementation within the KCcmBlockCipher function. The issue occurs when messages are encrypted without associated data, as the G1 block—which binds the nonce, message length, and parameter flags into the CBC-MAC (Cipher Block Chaining Message Authentication Code)—is only processed when associated data is present. Consequently, the authentication tag becomes a CBC-MAC of the plaintext alone and remains independent of the nonce. This allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags. Only applications that use KCcmBlockCipher directly and provide no associated data are affected.

Recommendations Update bc-csharp to version 2.7.0 or later. As a temporary mitigation, avoid using the KCcmBlockCipher function without providing associated data.