CVE-2026-63573: Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Q: Which deployments are exposed to this attack?

Deployments using bc-csharp before 2.7.0 to decrypt CMS EnvelopedData with RSA PKCS#1 v1.5 key transport are exposed if they reveal whether failure occurred during key unwrap or later during content decryption.

Q: What does an attacker need to exploit the issue?

The attacker needs a captured CMS EnvelopedData message and the ability to submit many modified versions of that message to an application that decrypts them using the recipient's RSA private key. The application must expose distinguishable failure behavior, including the distinct bad-padding exception from key unwrap.

Q: What information can be recovered if exploitation succeeds?

A successful adaptive chosen-ciphertext attack can recover the captured message's content-encryption key. The attacker can then decrypt that message's content.

Q: What is the remediation?

Upgrade bc-csharp to version 2.7.0 or later. The affected behavior is present in versions before 2.7.0.

Published Oct 2, 2026

Updated

Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.

Affected Software

1 affected component

Bouncy Castle bc-csharp<2.7.0

Event History

Oct 2, 2026

CVE Published

via MITRE·07:05 AM

Data Sourced

via MITRE·07:05 AM

DescriptionWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this attack?

Deployments using bc-csharp before 2.7.0 to decrypt CMS EnvelopedData with RSA PKCS#1 v1.5 key transport are exposed if they reveal whether failure occurred during key unwrap or later during content decryption.

What does an attacker need to exploit the issue?

The attacker needs a captured CMS EnvelopedData message and the ability to submit many modified versions of that message to an application that decrypts them using the recipient's RSA private key. The application must expose distinguishable failure behavior, including the distinct bad-padding exception from key unwrap.

What information can be recovered if exploitation succeeds?

A successful adaptive chosen-ciphertext attack can recover the captured message's content-encryption key. The attacker can then decrypt that message's content.

What is the remediation?

Upgrade bc-csharp to version 2.7.0 or later. The affected behavior is present in versions before 2.7.0.

CVE-2026-63573: Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this attack?

What does an attacker need to exploit the issue?

What information can be recovered if exploitation succeeds?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this attack?

What does an attacker need to exploit the issue?

What information can be recovered if exploitation succeeds?

What is the remediation?