CVE-2026-71884
Description
A flaw was found in Bouncy Castle. The native one-shot Counter (CTR) mode cipher fails to verify that the input data length fits within the counter space defined by the initialization vector. When processing overly long inputs, the counter wraps around and causes the keystream to repeat. This flaw allows an attacker to recover sensitive plaintext directly from the ciphertext without the encryption key, resulting in information disclosure.
Statement
A flaw was found in Bouncy Castle's native one-shot Counter (CTR) mode cipher implementation. When processing a message with a short counter space (initialization vector of 13 to 15 bytes), the native path fails to validate if the input length exceeds the available counter range. Processing an overly long input causes the block counter to wrap, leading to keystream repetition within the same packet. A remote unauthenticated attacker can exploit this keystream reuse to recover sensitive plaintext directly from the ciphertext without knowing the encryption key.
Mitigation
Configure applications using Bouncy Castle to use Java-based streaming CTR mode ciphers or ensure Initialization Vectors (IVs) are restricted to 12 bytes or fewer to prevent counter exhaustion. Alternatively, enforce application-level input payload limits that do not exceed the counter space.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
Potentially a replay attack, in which an attacker could send the same data twice, could be crafted if nonces are allowed to be reused. This could allow a user to send a message which masquerades as a valid message from a valid user.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
