bc-csharp: Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 unwrap
Summary
The CMS EnvelopedData decryption in bc-csharp (BouncyCastle.Cryptography) before 2.7.0 rejects RSA PKCS#1 v1.5 key-transport ciphertexts with invalid padding with a distinct error, while correctly padded ciphertexts fail only later at content decryption. An application that decrypts messages from untrusted parties and reveals this difference acts as a padding oracle. An attacker who holds a captured message and can submit many modified messages (typically thousands to millions) can recover the content-encryption key and read the message; the RSA private key is not disclosed. CVSS v4.0 base score is 8.2 (High), with impact limited to confidentiality.
Affected
- bc-csharp (BouncyCastle.Cryptography) versions 0 to before 2.7.0
- Applications that decrypt CMS EnvelopedData or AuthenticatedData with rsaEncryption key-transport recipients
- Vendor wiki lists 2.6.2 and earlier and 2.7.0-beta.98 as affected
Fixed in
- Fixed in bc-csharp 2.7.0
Workaround
- Upgrading is the fix; no workaround is provided by the CVE record.
- If upgrade is not immediately possible and all senders use RSA-OAEP or key agreement, refuse recipients whose KeyEncryptionAlgOid is rsaEncryption (1.2.840.113549.1.1.1) before calling GetContent or GetContentStream.
- Handle and report all decryption failures identically and without detail to the sender.
- The setting Org.BouncyCastle.Cms.AllowLenientRsaPkcs1 must stay at its default (false); enabling it restores the vulnerable behaviour.
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS 0.00308 (very low).
- No public proof of concept found in limited searches.
Our recommendation
- Identify applications that embed BouncyCastle.Cryptography (check software inventories and SBOMs for versions below 2.7.0).
- Check whether these applications decrypt CMS or S/MIME messages from untrusted parties.
- Upgrade to bc-csharp 2.7.0 or later, prioritising services that handle CMS messages from external senders.
- Until patched, make sure decryption errors are not disclosed to senders and restrict who can submit messages to such endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor wiki advisory CVE-2026-63573 github.com
- Fix commit: constant-time unwrap with random-key fallback github.com
- Fix commit: constant-time RSA PKCS#1 v1.5 helper github.com
- OSV entry CVE-2026-63573 osv.dev
- BouncyCastle.Cryptography on NuGet www.nuget.org
- Bouncy Castle C# 2.7.0 release notes www.bouncycastle.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:28.
Original description (NVD)
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.