CVE-2026-63573: BouncyCastle .NET RSA PKCS#1 v1.5 Padding Oracle Vulnerability

Vulnerability Overview CVE ID: CVE-2026-63573 Description: When decrypting CMS EnvelopedData (e.g., S/MIME messages), if the content encryption key is transported using RSA PKCS#1 v1.5 ( algorithm) and the ciphertext padding is invalid, directly accepts the key transport ciphertext and throws a with the message “bad padding in message”. Correctly padded ciphertext should proceed to content encryption and fail, if applicable, only once. Applications decrypting messages from untrusted sources, or applications that exhibit different behaviors via error returns, functional differences, or timing side-channels, can thus be exploited as a Bleichenbacher padding oracle for RSA keys. The same issue applies to key transport recipients in CMS AuthenticatedData. Attack Scenario: An attacker can capture encrypted messages and keys, then submit a large number of modified ciphertexts (typically thousands to millions) to the application to decrypt the content encryption key and the message from the captured data. Since the oracle operates on the raw RSA value, if the message key is wrapped using RSA-OAEP with the same RSA key, the same method can be used to attack RSA-OAEP, provided the application accepts recipients. BC.NET 2.7.0 Behavior: BC.NET 2.7.0 performs constant-time operations on recipients regarding content encryption key length. If padding is invalid, it uses a random key instead of throwing an error. This requires the content encryption algorithm to have a fixed key length: AES, ARIA, Camellia, DES, Triple-DES with three keys, IDEA, or SEED. For other algorithms, such as RC2, RC4, CAST5, or HMAC algorithms in AuthenticatedData, recipients now default to using . The previous behavior, including the oracle, can be restored by setting the property to , either via environment variables or through thread-local . This is not recommended, as it allows decryption of untrusted messages. RSA-OAEP and key agreement recipients are handled as before. Earlier Versions: Earlier versions did not provide a setting to remove the oracle, so upgrading is recommended. If an immediate upgrade is not possible, application senders should refuse recipients by using RSA-OAEP or key agreement, or by rejecting recipients if the is (1.2.840.113549.1.1.1) before calling or . Otherwise, every decryption failure, whether due to unwrap failure or content decryption failure, should be handled and reported to the sender in the same manner, although timing differences may still exist. Impact Scope Affected Versions: BC.NET 2.6.2 and earlier, as well as the 2.7.0-beta.98 pre-release version. Platform: All CLR. Remediation Fixed Version: BC.NET 2.7.0. POC Code / Exploit Code Commit Links: - https://github.com/bcgit/bc-csharp/commit/85679c7023ad4fe2a0650b88a1f498679c7463 (Constant-time unwrap with random fallback) - https://github.com/bcgit/bc-csharp/commit/c38b4790c2ae68f11a511373b4ae20c5590 (Constant-time RSA PKCS#1 v1.5 helper using RSA) Additional Information Discoverer: Claude, the AI assistant by Anthropic, discovered in collaboration between the Anthropic Safety Team and Anthropic Research.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63573: BouncyCastle .NET RSA PKCS#1 v1.5 Padding Oracle Vulnerability

More from this source