Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-71892— CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

Quick assessment

Affected

Legion of the Bouncy Castle Inc. BC-JAVA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Bouncy Castle for Java 1.86 之前的版本中，针对 CMS 密钥传输接收方（）的可选密钥长度验证功能，在使用 RFC 9709 内容加密密钥派生（）的消息上从未执行。原本应选择在密钥派生参数中携带的实际内容加密算法的代码分支，将加密密钥的字节数组与对象标识符（OID）进行了比较。由于这是对字节数组与之间的比较，其结果始终为 false，因此该检查最终回退到对外层包装 OID 的密钥长度查找。该 OID 标识的是密钥派生构造而非密码算法，且没有注册密钥长度，因此整个密钥长度比较被

CVSS 6.9 · Medium Updated Oct 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

Source: CVE Program / CVE List V5

Vulnerability Description

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256). The branch that should have selected the actual content-encryption algorithm carried in the key derivation AlgorithmIdentifier's parameters compared the encrypted-key byte array against the id-alg-cek-hkdf-sha256 object identifier, a comparison between a byte array and an ASN1ObjectIdentifier that is false for every possible input, so the check fell through to a key-size lookup on the outer wrapper OID. That OID identifies a key-derivation construction rather than a cipher and has no registered key size, so the size comparison was skipped entirely. A key-transport EnvelopedData or AuthEnvelopedData whose transported, HKDF-derived content-encryption key did not match the key size of the advertised content-encryption algorithm was therefore accepted even with validation explicitly enabled, silently defeating the only mechanism the API offers for enforcing recovered key size. The recipient now dispatches on the content-encryption AlgorithmIdentifier's algorithm OID, so validation checks the recovered key against the inner content-encryption algorithm. Messages with a matching key size, non-HKDF messages, and recipients that do not enable validation are unaffected. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/U:Amber

Source: CVE Program / CVE List V5

Vulnerability Type

不充分的比较

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Legion of the Bouncy Castle Inc.	BC-JAVA	1.78 ~ 1.86	-
Legion of the Bouncy Castle Inc.	BC-FJA	2.0.7 ~ 2.0.13	-

II. Public POCs for CVE-2026-71892

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-71892

请登录查看更多情报信息。

Other References for CVE-2026-71892 (2)

https://www.cve.org/CVERecord?id=CVE-2026-71892

Same Patch Batch · Legion of the Bouncy Castle Inc. · 2026-10-03 · 12 CVEs total

CVE-2026-71885	9.2 CRITICAL	MLS X.509 credential not bound to the LeafNode signature key
CVE-2026-71888	8.7 HIGH	CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent
CVE-2026-71889	8.7 HIGH	PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate
CVE-2026-71890	8.7 HIGH	MLS external commit can remove an arbitrary group member
CVE-2026-85515	8.2 HIGH	OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check
CVE-2026-71887	8.2 HIGH	OpenPGP data signature accepted from a signing subkey without cross-certification
CVE-2026-71883	8.2 HIGH	Native AES packet cipher returns the raw AES key on an alias
CVE-2026-71886	8.2 HIGH	OpenPGP certification accepted from a subkey without certification authority
CVE-2026-71891	7.1 HIGH	BLS12-381 key validation accepts a public key built on a foreign curve
CVE-2026-18040	5.9 MEDIUM	HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-depen
CVE-2026-97873	5.3 MEDIUM	Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

IV. Related Vulnerabilities

Same product: BC-JAVA

Same vendor: Legion of the Bouncy Castle Inc.

Same weakness: CWE-697

V. Comments for CVE-2026-71892

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-71892— CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-71892

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-71892

III. Intelligence Information for CVE-2026-71892

Other References for CVE-2026-71892 (2)

Same Patch Batch · Legion of the Bouncy Castle Inc. · 2026-10-03 · 12 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-71892

Leave a comment