Bouncy Castle for Java LTS: Exposure of AES key via in-place native packet cipher
Summary
In the Bouncy Castle for Java LTS build, the native one-shot AES packet ciphers (AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV) return the raw AES key instead of ciphertext when the same Java array is used as both input and output, for example when encrypting in place over the key array. The call still returns the correct output length, so the error is not visible to the application. An attacker who can observe or receive the output may obtain the key, which requires an application that uses this pattern and runs on x86/x86-64 with native support enabled.
Affected
- bcprov-lts (Bouncy Castle for Java LTS) from 2.73.4 before 2.73.13
- Only on x86/x86-64 Intel platforms with native support enabled, Java 8 and later
- Not affected: bcprov (plain Bouncy Castle for Java), pure-Java packet ciphers and streaming native modes
Fixed in
- Fixed in BC-LTS 2.73.13
Workaround
- No workaround documented by the vendor; upgrading to 2.73.13 is the fix.
- Unverified suggestion: avoid using the same array as key, IV or AAD and as output buffer for one-shot native AES ciphers, or use pure-Java ciphers for those calls, until the upgrade is done. Test before relying on this.
Exploitation
- No reports of exploitation in the wild and no public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS 0.00253 (modelled estimate, not evidence of exploitation).
Our recommendation
- Check whether bcprov-lts 2.73.4 to 2.73.12 is in use, via Maven or Gradle dependency lists, vendor-supplied Java applications or a software bill of materials. Plain bcprov is not affected.
- Update bcprov-lts to 2.73.13.
- Review in-house code that encrypts in place over key, IV or AAD arrays, and check output for leaked keys after the upgrade.
- Until the update is done, avoid the in-place aliasing pattern in affected applications.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-71883 vendor wiki (Bouncy Castle) github.com
- Bouncy Castle LTS 2.73.13 release notes www.bouncycastle.org
- OSV entry CVE-2026-71883 osv.dev
- VulDB CVE-2026-71883 vuldb.com
- Keyfactor release notes for BC-LTS 2.73.13 support.keyfactor.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:05.
Original description (NVD)
In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. Those arrays are read-only to the native code, and on a JVM that returns a copy rather than a pin the copy still holds the input bytes as they were read. The output buffer is taken through a separate critical region and committed first, so where an application passed the same Java array as both an input and the destination - encrypting in place over KeyParameter.getKey(), for example - the later mode-0 release of the key wrote the unchanged key bytes over the ciphertext that had just been produced. The call still returned the correct output length, so an application encrypting in place over its own key array was handed the raw AES key where it expected ciphertext, with nothing in the API to indicate it, and would transmit or store the key in place of the message. The read-only input arrays are now released with JNI_ABORT, freeing the native copy without copying it back, and mode 0 is reserved for arrays the native code wrote. The pure-Java packet ciphers and the streaming native modes are not affected. Bouncy Castle for Java (bcprov) is not affected, as it ships no native implementations.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.