CVE-2026-71888

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71888", "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630", "state": "PUBLISHED", "assignerShortName": "bcorg", "dateReserved": "2026-08-08T00:06:07.401Z", "datePublished": "2026-10-03T08:36:12.960Z", "dateUpdated": "2026-10-05T16:52:07.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630", "shortName": "bcorg", "dateUpdated": "2026-10-03T08:36:12.960Z"}, "title": "CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value", "type": "CWE"}]}], "affected": [{"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-JAVA", "platforms": ["all"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "packageName": "bcpkix", "repo": "https://github.com/bcgit/bc-java", "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on", "modules": ["pkix"], "programFiles": ["CMSAuthenticatedDataParser"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.86", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-JAVA", "platforms": ["all"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "packageName": "bcutil", "repo": "https://github.com/bcgit/bc-java", "packageURL": "pkg:maven/org.bouncycastle/bcutil-jdk18on", "modules": ["util"], "programFiles": ["AuthenticatedData"], "versions": [{"status": "affected", "version": "1.70", "lessThan": "1.86", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-LTS-JAVA", "platforms": ["all"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/", "packageName": "bcpkix-lts8on", "repo": "https://github.com/bcgit/bc-lts-java", "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on", "modules": ["pkix"], "programFiles": ["CMSAuthenticatedDataParser"], "versions": [{"status": "affected", "version": "2.73.0", "lessThan": "2.73.13", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-LTS-JAVA", "platforms": ["all"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/", "packageName": "bcutil-lts8on", "repo": "https://github.com/bcgit/bc-lts-java", "packageURL": "pkg:maven/org.bouncycastle/bcutil-lts8on", "modules": ["util"], "programFiles": ["AuthenticatedData"], "versions": [{"status": "affected", "version": "2.73.0", "lessThan": "2.73.13", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-FJA", "platforms": ["all"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/", "packageName": "bcpkix-fips", "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.13", "versionType": "maven"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.13", "versionType": "maven"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.13", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-FJA", "platforms": ["all"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/", "packageName": "bcutil-fips", "packageURL": "pkg:maven/org.bouncycastle/bcutil-fips", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.8", "versionType": "maven"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.8", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).</p>"}]}], "references": [{"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888", "tags": ["vendor-advisory"]}, {"url": "https://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber"}}], "credits": [{"lang": "en", "value": "Bhargava Shastry", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "bc release-notes template"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T16:51:49.725826Z", "id": "CVE-2026-71888", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T16:52:07.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71888", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T16:51:49.725826Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T16:52:03.911Z"}}], "cna": {"title": "CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Bhargava Shastry"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/bcgit/bc-java", "vendor": "Legion of the Bouncy Castle Inc.", "modules": ["pkix"], "product": "BC-JAVA", "versions": [{"status": "affected", "version": "0", "lessThan": "1.86", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on", "packageName": "bcpkix", "programFiles": ["CMSAuthenticatedDataParser"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "defaultStatus": "unaffected"}, {"repo": "https://github.com/bcgit/bc-java", "vendor": "Legion of the Bouncy Castle Inc.", "modules": ["util"], "product": "BC-JAVA", "versions": [{"status": "affected", "version": "1.70", "lessThan": "1.86", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcutil-jdk18on", "packageName": "bcutil", "programFiles": ["AuthenticatedData"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "defaultStatus": "unaffected"}, {"repo": "https://github.com/bcgit/bc-lts-java", "vendor": "Legion of the Bouncy Castle Inc.", "modules": ["pkix"], "product": "BC-LTS-JAVA", "versions": [{"status": "affected", "version": "2.73.0", "lessThan": "2.73.13", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on", "packageName": "bcpkix-lts8on", "programFiles": ["CMSAuthenticatedDataParser"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/", "defaultStatus": "unaffected"}, {"repo": "https://github.com/bcgit/bc-lts-java", "vendor": "Legion of the Bouncy Castle Inc.", "modules": ["util"], "product": "BC-LTS-JAVA", "versions": [{"status": "affected", "version": "2.73.0", "lessThan": "2.73.13", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcutil-lts8on", "packageName": "bcutil-lts8on", "programFiles": ["AuthenticatedData"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/", "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-FJA", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.13", "versionType": "maven"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.13", "versionType": "maven"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.13", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips", "packageName": "bcpkix-fips", "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/", "defaultStatus": "unaffected"}, {"vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-FJA", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.8", "versionType": "maven"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.8", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcutil-fips", "packageName": "bcutil-fips", "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888", "tags": ["vendor-advisory"]}, {"url": "https://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95", "tags": ["patch"]}], "x_generator": {"engine": "bc release-notes template"}, "descriptions": [{"lang": "en", "value": "In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).", "supportingMedia": [{"type": "text/html", "value": "<p>In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value"}]}], "providerMetadata": {"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630", "shortName": "bcorg", "dateUpdated": "2026-10-03T08:36:12.960Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71888", "state": "PUBLISHED", "dateUpdated": "2026-10-05T16:52:07.424Z", "dateReserved": "2026-08-08T00:06:07.401Z", "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630", "datePublished": "2026-10-03T08:36:12.960Z", "assignerShortName": "bcorg"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "defaultStatus": "unaffected", "modules": ["pkix"], "packageName": "bcpkix", "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on", "platforms": ["all"], "product": "BC-JAVA", "programFiles": ["CMSAuthenticatedDataParser"], "repo": "https://github.com/bcgit/bc-java", "vendor": "Legion of the Bouncy Castle Inc.", "versions": [{"lessThan": "1.86", "status": "affected", "version": "0", "versionType": "maven"}]}, {"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "defaultStatus": "unaffected", "modules": ["util"], "packageName": "bcutil", "packageURL": "pkg:maven/org.bouncycastle/bcutil-jdk18on", "platforms": ["all"], "product": "BC-JAVA", "programFiles": ["AuthenticatedData"], "repo": "https://github.com/bcgit/bc-java", "vendor": "Legion of the Bouncy Castle Inc.", "versions": [{"lessThan": "1.86", "status": "affected", "version": "1.70", "versionType": "maven"}]}, {"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/", "defaultStatus": "unaffected", "modules": ["pkix"], "packageName": "bcpkix-lts8on", "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on", "platforms": ["all"], "product": "BC-LTS-JAVA", "programFiles": ["CMSAuthenticatedDataParser"], "repo": "https://github.com/bcgit/bc-lts-java", "vendor": "Legion of the Bouncy Castle Inc.", "versions": [{"lessThan": "2.73.13", "status": "affected", "version": "2.73.0", "versionType": "maven"}]}, {"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/", "defaultStatus": "unaffected", "modules": ["util"], "packageName": "bcutil-lts8on", "packageURL": "pkg:maven/org.bouncycastle/bcutil-lts8on", "platforms": ["all"], "product": "BC-LTS-JAVA", "programFiles": ["AuthenticatedData"], "repo": "https://github.com/bcgit/bc-lts-java", "vendor": "Legion of the Bouncy Castle Inc.", "versions": [{"lessThan": "2.73.13", "status": "affected", "version": "2.73.0", "versionType": "maven"}]}, {"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/", "defaultStatus": "unaffected", "packageName": "bcpkix-fips", "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips", "platforms": ["all"], "product": "BC-FJA", "vendor": "Legion of the Bouncy Castle Inc.", "versions": [{"lessThan": "1.0.13", "status": "affected", "version": "1.0.0", "versionType": "maven"}, {"lessThan": "2.0.13", "status": "affected", "version": "2.0.0", "versionType": "maven"}, {"lessThan": "2.1.13", "status": "affected", "version": "2.1.0", "versionType": "maven"}]}, {"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/", "defaultStatus": "unaffected", "packageName": "bcutil-fips", "packageURL": "pkg:maven/org.bouncycastle/bcutil-fips", "platforms": ["all"], "product": "BC-FJA", "vendor": "Legion of the Bouncy Castle Inc.", "versions": [{"lessThan": "2.0.8", "status": "affected", "version": "2.0.0", "versionType": "maven"}, {"lessThan": "2.1.8", "status": "affected", "version": "2.1.0", "versionType": "maven"}]}], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series)."}], "id": "CVE-2026-71888", "lastModified": "2026-10-06T14:49:40.823", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "91579145-5d7b-4cc5-b925-a0262ff19630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71888", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T16:51:49.725826Z", "version": "2.0.3"}}]}, "published": "2026-10-03T09:17:05.250", "references": [{"source": "91579145-5d7b-4cc5-b925-a0262ff19630", "url": "https://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95"}, {"source": "91579145-5d7b-4cc5-b925-a0262ff19630", "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888"}], "sourceIdentifier": "91579145-5d7b-4cc5-b925-a0262ff19630", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "91579145-5d7b-4cc5-b925-a0262ff19630", "type": "Secondary"}]}

{"bugzilla": {"description": "org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcutil-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcutil-fips: org.bouncycastle:bcpkix-jdk15on: org.bouncycastle:bcutil-jdk15on: org.bouncycastle:bcpkix-jdk15to18: org.bouncycastle:bcutil-jdk15to18: org.bouncycastle:bcpkix-lts8on: org.bouncycastle:bcutil-lts8on: bouncycastle: Bouncy Castle: Security bypass via unvalidated attributes in CMS AuthenticatedData parser", "id": "2545494", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545494"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-349", "details": ["In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).", "A flaw was found in Bouncy Castle. In its Cryptographic Message Syntax (CMS) streaming parser, messages with mismatched attribute and algorithm fields are improperly handled, allowing attributes to be returned as valid even though they were not protected by the Message Authentication Code (MAC). A remote attacker capable of intercepting and modifying network traffic can exploit this flaw by inserting unauthorized attributes into an otherwise valid message. This can allow an attacker to manipulate application behavior and bypass security checks if the application relies on those attributes to make authorization or routing decisions."], "mitigation": {"lang": "en:us", "value": "Avoid using CMSAuthenticatedDataParser to stream untrusted CMS AuthenticatedData structures, or validate that messages containing authenticated attributes explicitly define a digestAlgorithm before trusting attribute values. Alternatively, process messages using non-streaming CMS parsers."}, "name": "CVE-2026-71888", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Not affected", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Not affected", "package_name": "jenkins-2-plugins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "ocp-tools-4/jenkins-rhel8", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "ocp-tools-4/jenkins-rhel9", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/de-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/de-supported-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Not affected", "package_name": "libarrow", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Not affected", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pki-core:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pki-deps:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "resteasy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk15on", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk15to18", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk15on", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-modelmesh-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/jetbrains-ide-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "bcpkix-jdk18on", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "bcutil-jdk18on", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-10-03T08:36:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71888\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71888\nhttps://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95\nhttps://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888"], "statement": "A flaw was found in Bouncy Castle's Cryptographic Message Syntax (CMS) streaming parser (CMSAuthenticatedDataParser). When parsing an AuthenticatedData structure where the digestAlgorithm field is absent but authenticated attributes (authAttrs) are present, the parser validates the Message Authentication Code (MAC) over content alone while returning authAttrs as authenticated. An attacker capable of modifying messages in transit can inject arbitrary attributes, such as security classification labels, into valid messages without holding MAC keys. This allows attackers to manipulate application authorization or routing decisions reliant on these attributes.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.0.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,2.1.13)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BC-FJA", "source": "cna", "vendor": "Legion of the Bouncy Castle Inc."}, "product": "bc-fja", "vendor": "legion_of_the_bouncy_castle_inc."}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,2.1.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BC-FJA", "source": "cna", "vendor": "Legion of the Bouncy Castle Inc."}, "product": "bc-fja", "vendor": "legion_of_the_bouncy_castle_inc."}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.86)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BC-JAVA", "source": "cna", "vendor": "Legion of the Bouncy Castle Inc."}, "product": "bc-java", "vendor": "legion_of_the_bouncy_castle_inc."}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.73.0,2.73.13)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BC-LTS-JAVA", "source": "cna", "vendor": "Legion of the Bouncy Castle Inc."}, "product": "bc-lts-java", "vendor": "legion_of_the_bouncy_castle_inc."}], "created": "2026-10-03T09:30:19.433786+00:00", "updated": "2026-10-17T10:00:08.607778+00:00", "vendors": ["legion_of_the_bouncy_castle_inc.", "legion_of_the_bouncy_castle_inc.$PRODUCT$bc-fja", "legion_of_the_bouncy_castle_inc.$PRODUCT$bc-java", "legion_of_the_bouncy_castle_inc.$PRODUCT$bc-lts-java"], "weaknesses": ["CWE-349", "CWE-354"]}