BouncyCastle BC C# CVE-2026-16000 CCM Authenticated Encryption Integrity Flaw and Fix

CVE-2026-16000 Vulnerability Summary Vulnerability Overview Vulnerability Name: CVE-2026-16000 Description: implements the CCM authenticated encryption mode of the Ukrainian DSTU 7624 standard, typically used in conjunction with (Kalyna). The mode begins with a CBC-MAC using block G1, binding the nonce, message length, and flags to the authentication tag. The implementation only handles G1 and processes associated data. When encrypting or decrypting a message, the tag is an MAC of the nonce and message length, independent of the associated data. This configuration effectively ignores the associated data defined in and , and is not invoked. Attack Scenario: An attacker can observe protected messages and either know or choose parts of the plaintext, thereby constructing ciphertexts with valid tags that will be accepted by the receiver as authentic. This does not directly leak the plaintext but compromises the integrity protection mechanism. Impact Scope Affected Versions: BC C.NET 2.6.2 and earlier, as well as the 2.7.0-beta.98 pre-release version. Platform Impact: All CLR environments. Remediation Fixed Version: BC C.NET 2.7.0 Remediation Details: - BC C.NET 2.7.0 consistently handles the G1 block and sets its associated data flag depending on whether associated data is present. Consequently, the tag depends on the nonce, message length, and presence of associated data, making each case distinct. No new settings are required. Due to changes in tag computation, messages generated by earlier versions without associated data cannot be verified under version 2.7.0. This version also fixes several other KCM defects, including a counter issue that caused the keystream to repeat every 256 blocks. - Earlier versions did not have a setting to prevent this issue, so an upgrade is recommended. If an immediate upgrade is not feasible, always provide associated data with . The associated data must be a non-empty multiple of the ciphertext block size, such as a fixed block identifier protocol or context, and the message format must be updated so that both sender and receiver are changed accordingly. Related Fixes: A similar issue was fixed in BC Java 1.85 (CVE-2026-12803). Fix Commit GitHub Link: https://github.com/bcgit/bc-csharp/commit/b01e9e60e231b90867bfa03bf148dbe0f9ccfb Discoverer Discoverer: Claude, an AI assistant by Anthropic Verification: Verified by Anthropic's security team in collaboration with Anthropic Research --- Code Block No POC code or exploit code available.

Goal Reached Thanks to every supporter — we hit 100%!

BouncyCastle BC C# CVE-2026-16000 CCM Authenticated Encryption Integrity Flaw and Fix

More from this source