Bouncy Castle for Java: CMS AuthenticatedData accepts attacker-inserted authAttrs
Summary
Bouncy Castle for Java, a cryptography library for Java, accepts CMS AuthenticatedData messages whose digestAlgorithm and authAttrs fields are inconsistent. The streaming parser then returns authenticated attributes that the message MAC never covered. An attacker who can modify a message in transit can insert an attribute such as an ESSSecurityLabel without holding any key, while the content remains MAC-protected. The risk is relevant only where an application makes authorization, routing or labelling decisions based on these attributes.
Affected
- Bouncy Castle for Java (BC) before 1.86
- BC-LTS for Java 2.73.0 to before 2.73.13
- BC-FJA bcpkix-fips 1.0.0 to before 1.0.13, 2.0.0 to before 2.0.13 and 2.1.0 to before 2.1.13
- BC-FJA bcutil-fips 2.0.0 to before 2.0.8 and 2.1.0 to before 2.1.8
Fixed in
- BC 1.86
- BC-LTS 2.73.13
- bcpkix-fips 1.0.13, 2.0.13 and 2.1.13
- bcutil-fips 2.0.8 and 2.1.8
Workaround
Unknown. No workaround was found in the vendor material. Upgrading is the recommended fix.
Exploitation
- No exploitation in the wild is known from the sources reviewed.
- No public proof of concept was found.
- CISA SSVC (CNA record): exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory Java applications and vendor products that embed bcpkix or bcutil, including transitive dependencies.
- Upgrade to BC 1.86, LTS 2.73.13 or the fixed FIPS versions. Version 1.85 alone does not fix this CVE.
- Ask vendors for builds based on a fixed Bouncy Castle version.
- Check whether any application processes CMS AuthenticatedData from untrusted sources and makes decisions based on authAttrs. Prioritise those systems.
- Re-check the NVD entry and the vendor wiki for updates, as the NVD entry was still awaiting analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit dcb683b (bc-java) github.com
- Vendor wiki: CVE-2026-71888 github.com
- Bouncy Castle Java 1.86 release notes www.bouncycastle.org
- bc-java discussion 2449 github.com
- SUSE CVE page CVE-2026-71888 www.suse.com
- Debian OSV record CVE-2026-71888 osv.dev
- Atlassian security bulletin October 2026 confluence.atlassian.com
- Vendor wiki: CVE-2026-59642 (related) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:41.
Original description (NVD)
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.