CVE-2026-103601: CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, because decryption wrote the recovered plaintext into the caller-supplied output buffer before checking the authentication tag and left it there when the check failed. Only decryption into a caller-supplied buffer is affected; methods that return a newly allocated array are not.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which applications are exposed to plaintext disclosure?
Applications using Bouncy Castle bc-csharp before 2.7.0 are exposed only when they decrypt CCM or DSTU 7624 CCM data into a caller-supplied output buffer and that buffer can be observed after authentication fails, such as through buffer reuse or logging. Decryption methods that return a newly allocated array are not affected.
What does an attacker need to do to exploit this?
An attacker needs to send forged ciphertext messages to a reachable application and have the application attempt decryption. Exploitation also requires that the attacker can obtain or observe contents left in the caller-supplied output buffer after the tag check fails.
What can be done if upgrading is not immediately possible?
Avoid decrypting CCM or DSTU 7624 CCM ciphertext into caller-supplied buffers where failed-decryption buffers could be reused, logged, returned, or otherwise exposed. Use decryption methods that return a newly allocated array instead, as those methods are not affected.
How can I determine whether my code is affected?
Review uses of CcmBlockCipher and KCcmBlockCipher in bc-csharp versions before 2.7.0. Focus on decryption paths that provide an output buffer and on whether that buffer remains accessible after a failed authentication-tag check.