CVE-2026-71883

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java LTS versions prior to 2.73.13

Description One-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM, and GCM-SIV incorrectly use JNI's ReleaseByteArrayElements in mode 0 when releasing the caller's key, IV, and additional authenticated data arrays. This mode commits the native copy back into the Java array. In scenarios where an application uses the same Java array for both input and destination—such as encrypting in place over KeyParameter.getKey()—the release of the key overwrites the produced ciphertext with the original unchanged key bytes. Consequently, the application receives the raw AES key instead of the expected ciphertext, which may lead to the key being transmitted or stored in place of the message. Pure-Java packet ciphers, streaming native modes, and Bouncy Castle for Java (bcprov) are not affected.

Recommendations Update Bouncy Castle for Java LTS to version 2.73.13 or later.