CVE-2026-71891— BLS12-381 密钥验证接受基于外部曲线的公钥
一分钟漏洞结论
影响对象
Legion of the Bouncy Castle Inc. BC-JAVA
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Bouncy Castle for Java 1.86 版本之前的实现中， 方法（以及 和所有 、 和 中依赖该方法进行验证和聚合验证的逻辑），接受了一个基于“外来”椭圆曲线（ECCurve）构建的公钥。该外来曲线仅与 BLS12-381 共享相同的域特征（field characteristic），但并非标准曲线。 由于质数阶子群检查（prime-order subgroup check）依赖于点自身所在曲线的协因子（cofactor）名称，而 在曲线的协因子为 1 时直接返回 true，因此，即使某个点实际
可能的 ATT&CK 技术 1 AI
T1556 · Modify Authentication Process
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-71891 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
BLS12-381 key validation accepts a public key built on a foreign curve
来源: CVE Program / CVE List V5
Vulnerability Description
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field characteristic. The prime-order subgroup check trusts a point's own curve to name its cofactor, since ECPoint.satisfiesOrder returns true outright when the curve's cofactor is one, so a point on a curve with a different equation and a cofactor forged to one passed keyValidate despite not being a G1 point at all. In BC's pairing implementation such a point contributes the identity in the target group, so an aggregate signature verified against a set of public keys including it is accepted even though it contains no signature for that key and message pair, admitting a phantom signer. keyValidate now first confirms that the point's curve carries exactly the canonical G1 field, equation, order and cofactor before any subgroup check. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key; the standard 48-byte compressed-point decoder always supplies the canonical curve and was never affected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
来源: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA | 1.85 ~ 1.86 | - |
|
二、漏洞 CVE-2026-71891 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-71891 的情报信息
请登录查看更多情报信息。
CVE-2026-71891 其他参考 (2)
同批安全公告 · Legion of the Bouncy Castle Inc. · 2026-10-03 · 共 12 条
| CVE-2026-71885 | 9.2 CRITICAL | MLS X.509凭证未绑定到LeafNode签名密钥 |
| CVE-2026-71888 | 8.7 HIGH | CMS 认证数据暴露攻击者插入的authAttrs |
| CVE-2026-71889 | 8.7 HIGH | PKIXCertPathReviewer X.509名称约束绕过漏洞 |
| CVE-2026-71890 | 8.7 HIGH | MLS外部提交可移除任意组成员漏洞 |
| CVE-2026-85515 | 8.2 HIGH | OpenPGP消息截断未报告，绕过SEIPDv1完整性检查 |
| CVE-2026-71887 | 8.2 HIGH | OpenPGP 签名子键无交叉认证漏洞 |
| CVE-2026-71883 | 8.2 HIGH | Native AES密文解析器泄露原始AES密钥 |
| CVE-2026-71886 | 8.2 HIGH | OpenPGP 子键无证书认证漏洞 |
| CVE-2026-71892 | 6.9 MEDIUM | RFC 9709 HKDF派生密钥未执行CMS密钥传输接收方密钥大小验证 |
| CVE-2026-18040 | 5.9 MEDIUM | HQC 通过秘密索引表和采样器泄露私钥信息 |
| CVE-2026-97873 | 5.3 MEDIUM | JCA原始提供程序未限制PBES1和PKCS#12迭代次数 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-71891
暂无评论