Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-203.
Summary
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | bc-csharp | before 2.7.0 | 2.7.0 | Patch available | CNA |
- bc-csharp VendorLegion of the Bouncy Castle Inc. Affected before 2.7.0 Fixed in 2.7.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-csharp:*:*:*:*:*:*:*:* | before 2.7.0 | Vulnerable | Legion of the Bouncy Castle Inc. |
- cpe:2.3:a:bouncycastle:bc-csharp:*:*:*:*:*:*:*:* Versions before 2.7.0 Vulnerable ·Legion of the Bouncy Castle Inc.
Remediation
- Fix · CNA bc-csharp (Legion of the Bouncy Castle Inc.) Fixed in 2.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Legion of the Bouncy Castle bc-csharp 2.7.0
21 records Highest priority Priority MEDIUM 8 MEDIUM, 13 LOW
Other records, highest priority first
- TI-2026-65844 MTI/A0 DHAgreement does not validate the peer's ephemeral valuePriority MEDIUM 47
- TI-2026-66020 Unbounded HSS public key level count allows huge array allocation during signature verificationPriority MEDIUM 44
- TI-2026-66017 Unbounded ASN.1 nesting depth causes process-terminating stack overflowPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63573
- 2026-10-03 Alias added: GHSA-xx4m-xv2j-xx6g
- 2026-10-28 CVSS score added · NVD
References
More Legion of the Bouncy Castle Inc. Bc-csharp vulnerabilities
- TI-2026-65844 MTI/A0 DHAgreement does not validate the peer's ephemeral value CVSS 4.0CRITICAL 9.1
- TI-2026-66020 Unbounded HSS public key level count allows huge array allocation during signature verification CVSS 4.0HIGH 8.7
- TI-2026-66017 Unbounded ASN.1 nesting depth causes process-terminating stack overflow CVSS 4.0HIGH 8.7
- TI-2026-65849 Unbounded allocation from OpenPGP signature and user attribute subpacket lengths CVSS 4.0HIGH 8.7
- TI-2026-65843 Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion CVSS 4.0HIGH 8.7
- TI-2026-65841 DTLS handshake reassembler allocates buffer from unchecked 24-bit length CVSS 4.0HIGH 8.7
Sources
- CVE-2026-63573 · CVE Program
- CVE-2026-63573 · NVD
- FIRST EPSS
- GHSA-xx4m-xv2j-xx6g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences