PT-2026-104569
CVE-2026-71890
·
تاريخ النشر
2026-10-03
·
تاريخ التحديث
2026-10-26
الوصف من
CVSS 4.0
8.7
عاليةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Name of the Vulnerable Software and Affected Versions
Bouncy Castle for Java versions prior to 1.86
Description
Validation of an MLS (RFC 9420) external commit's proposal list in the
validateExternalCachedProposals() function of org.bouncycastle.mls.protocol.Group failed to verify that a removed leaf was associated with the joiner. While RFC 9420 allows a joiner to remove an old version of themselves via a Remove proposal, the implementation did not ensure the LeafNode met the necessary credential criteria for the removed participant. Consequently, any party with the group's public GroupInfo could submit a Remove proposal specifying any member's LeafIndex, allowing them to evict that member and occupy their slot in the ratchet tree. This issue affected callers of the Group.externalJoin and Group.handle APIs, as the required credential check was only present in the gRPC interop harness.Recommendations
Update Bouncy Castle for Java to version 1.86 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾