CVE-2026-103601: CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

Q: Which applications are exposed to plaintext disclosure?

Applications using Bouncy Castle bc-csharp before 2.7.0 are exposed only when they decrypt CCM or DSTU 7624 CCM data into a caller-supplied output buffer and that buffer can be observed after authentication fails, such as through buffer reuse or logging. Decryption methods that return a newly allocated array are not affected.

Q: What does an attacker need to do to exploit this?

An attacker needs to send forged ciphertext messages to a reachable application and have the application attempt decryption. Exploitation also requires that the attacker can obtain or observe contents left in the caller-supplied output buffer after the tag check fails.

Q: What can be done if upgrading is not immediately possible?

Avoid decrypting CCM or DSTU 7624 CCM ciphertext into caller-supplied buffers where failed-decryption buffers could be reused, logged, returned, or otherwise exposed. Use decryption methods that return a newly allocated array instead, as those methods are not affected.

Q: How can I determine whether my code is affected?

Review uses of CcmBlockCipher and KCcmBlockCipher in bc-csharp versions before 2.7.0. Focus on decryption paths that provide an output buffer and on whether that buffer remains accessible after a failed authentication-tag check.

Published Oct 2, 2026

Updated

Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, because decryption wrote the recovered plaintext into the caller-supplied output buffer before checking the authentication tag and left it there when the check failed. Only decryption into a caller-supplied buffer is affected; methods that return a newly allocated array are not.

Affected Software

1 affected component

Bouncy Castle bc-csharp<2.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bc-csharp to a version that resolves this vulnerability.
Fixed in 2.7.0

Event History

Oct 2, 2026

CVE Published

via MITRE·07:09 AM

Data Sourced

via MITRE·07:09 AM

DescriptionWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to plaintext disclosure?

Applications using Bouncy Castle bc-csharp before 2.7.0 are exposed only when they decrypt CCM or DSTU 7624 CCM data into a caller-supplied output buffer and that buffer can be observed after authentication fails, such as through buffer reuse or logging. Decryption methods that return a newly allocated array are not affected.

What does an attacker need to do to exploit this?

An attacker needs to send forged ciphertext messages to a reachable application and have the application attempt decryption. Exploitation also requires that the attacker can obtain or observe contents left in the caller-supplied output buffer after the tag check fails.

What can be done if upgrading is not immediately possible?

Avoid decrypting CCM or DSTU 7624 CCM ciphertext into caller-supplied buffers where failed-decryption buffers could be reused, logged, returned, or otherwise exposed. Use decryption methods that return a newly allocated array instead, as those methods are not affected.

How can I determine whether my code is affected?

Review uses of CcmBlockCipher and KCcmBlockCipher in bc-csharp versions before 2.7.0. Focus on decryption paths that provide an output buffer and on whether that buffer remains accessible after a failed authentication-tag check.

CVE-2026-103601: CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to plaintext disclosure?

What does an attacker need to do to exploit this?

What can be done if upgrading is not immediately possible?

How can I determine whether my code is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to plaintext disclosure?

What does an attacker need to do to exploit this?

What can be done if upgrading is not immediately possible?

How can I determine whether my code is affected?