TI-2026-67478 Aliases CVE-2026-71891 GHSA-gggh-4cvh-v637

BLS12-381 key validation accepts a public key built on a foreign curve

LOW 30CWE-347Published 2026-10-03 · Updated 2026-10-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field characteristic. The prime-order subgroup check trusts a point's own curve to name its cofactor, since ECPoint.satisfiesOrder returns true outright when the curve's cofactor is one, so a point on a curve with a different equation and a cofactor forged to one passed keyValidate despite not being a G1 point at all. In BC's pairing implementation such a point contributes the identity in the target group, so an aggregate signature verified against a set of public keys including it is accepted even though it contains no signature for that key and message pair, admitting a phantom signer. keyValidate now first confirms that the point's curve carries exactly the canonical G1 field, equation, order and cofactor before any subgroup check. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key; the standard 48-byte compressed-point decoder always supplies the canonical curve and was never affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00174 6th percentileScored 2026-11-07

Fix Fixed BC-JAVA (Legion of the Bouncy Castle Inc.): 1.86

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Legion of the Bouncy Castle Inc.	BC-JAVA	1.85 to before 1.86	1.86	Patch available	CNA

BC-JAVA VendorLegion of the Bouncy Castle Inc. Affected 1.85 to before 1.86 Fixed in 1.86 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:bouncycastle:bc-java::::::::	—	—	Legion of the Bouncy Castle Inc.

cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions — — ·Legion of the Bouncy Castle Inc.

Remediation

Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.86

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-03
Legion of the Bouncy Castle BC-JAVA 1.86
11 records Highest priority Priority MEDIUM 4 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-67477 MLS external commit can remove an arbitrary group memberPriority MEDIUM 43
- TI-2026-67476 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificatePriority MEDIUM 43
- TI-2026-67475 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentPriority MEDIUM 42
Show all 11 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-03 Threatist record created from CVE-2026-71891
2026-10-03 Alias added: GHSA-gggh-4cvh-v637
2026-10-04 Priority changed: MEDIUM → LOW
2026-10-05 CISA SSVC decision points changed
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat

References

Patch 1

https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb

Advisory 1

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891

TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3

See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences