CVE-2026-71883
Description
A flaw was found in Bouncy Castle for Java LTS. This flaw can lead to information disclosure when an application performs in-place encryption using native packet ciphers. Due to improper memory handling in native code bindings, the library overwrites the newly produced ciphertext with the original unencrypted key or input data. As a result, an attacker could obtain the raw secret key because the application unknowingly stores or transmits the unencrypted key in place of the intended ciphertext.
Statement
This vulnerability is rated as Moderate impact because successful exposure of cryptographic material depends on an unusual execution pattern where an application reuses its secret key buffer as the output target during one-shot native cipher processing. Under default configurations and standard usage relying on pure-Java cryptographic providers or streaming cipher modes, deployments are not susceptible to this flaw. The potential exposure of secret keys is restricted to scenarios involving one-shot native packet ciphers paired with JVM implementations that copy rather than pin memory arrays during native execution.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Other,Access Control
Technical Impact: Quality Degradation; Gain Privileges or Assume Identity; Unexpected State; Varies by Context
This weakness can cause unintended, always-incorrect behavior. It can lead to additional weaknesses such as allowing an attacker to gain unintended access to system resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
