Bouncy Castle bc-csharp: Improper input validation in DHAgreement
Summary
The DHAgreement class in bc-csharp before 2.7.0 does not validate the peer's ephemeral value in the MTI/A0 Diffie-Hellman key agreement. An on-path attacker can force the agreed value to a known result, so the application derives keys the attacker knows. A malicious peer can also learn the local static private key, in some groups fully recovered. Only applications that call DHAgreement directly are affected; the TLS code and DHBasicAgreement are not.
Affected
- BC C# .NET 2.6.2 and earlier
- BC C# .NET 2.7.0-beta.98 (pre-release)
- Applications that call DHAgreement directly
Fixed in
- BC C# .NET 2.7.0
Workaround
Unknown. No workaround is documented by the vendor. Upgrading is the documented remedy. Developers may validate the peer ephemeral value by constructing DHPublicKeyParameters from it with the same domain parameters before calling CalculateAgreement, and abandon the exchange if the constructor throws.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact total
- Not listed in CISA KEV
- No public proof of concept found in primary sources
Our recommendation
- Inventory .NET applications and dependencies for BouncyCastle.Cryptography or bc-csharp below 2.7.0, including transitive dependencies
- Upgrade to bc-csharp 2.7.0 or later
- Check whether custom code calls DHAgreement directly and prioritise those systems
- Until patched, limit on-path exposure of affected systems on untrusted network segments
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory (GitHub wiki) github.com
- Fix commit github.com
- OSV entry osv.dev
- Bouncy Castle C# 2.7.0 download page www.bouncycastle.org
- Bouncy Castle C# 2.7.0 release announcement www.bouncycastle.org
- OpenCVE entry app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:37.
Original description (NVD)
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors. The attack uses a crafted out-of-range or small-order ephemeral value, and works because that value is raised to the static private key without the range and subgroup-membership checks applied to DH public keys. Only applications that call DHAgreement directly are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.