CVE-2026-63569

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description Improper input validation in the CalculateAgreement() function of the DHAgreement class (MTI/A0 two-pass Diffie-Hellman) allows an on-path attacker to force the local party to compute an agreed value already known to the attacker, bypassing the key authentication provided by MTI/A0. Additionally, a malicious peer can learn the local static private key modulo the small factors of p-1, potentially recovering the key entirely in groups with many such factors. This occurs because crafted out-of-range or small-order ephemeral values are raised to the static private key without the necessary range and subgroup-membership checks typically applied to DH public keys. Only applications that call DHAgreement directly are affected.

Recommendations Update bc-csharp to version 2.7.0 or later. As a temporary mitigation, restrict the direct use of the DHAgreement class until the update is applied.