Bug 2545495 (CVE-2026-71892)

Summary: CVE-2026-71892 org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: bouncycastle: Bouncy Castle: Key-size validation bypass via improper algorithm check
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, anthomas, ant, anujha, aoconnor, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, bniver, boliveir, bstansbe, cescoffi, csuconic, dbruscin, dfreiber, dlofthou, drichtar, drow, dschmidt, ehelms, ehugonne, flucifre, fmariani, fmongiar, ggainey, gmalinko, gmeno, groman, gsmet, gtanzill, gtully, ikhan, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jlanda, jmartisk, jnethert, jpasqual, jsherman, juwatts, jwon, kshier, kvanderr, manderse, mbenjamin, mcarlett, mdellweg, mhackett, mhulan, mosmerov, mposolda, msvehla, nmoumoul, nwallace, olubyans, osousa, ozzy, pberan, pcreech, pdelbell, pesilva, pjindal, pmackay, rbobbitt, rchan, rgemmell, rgodfrey, rguimara, rhel-process-autobot, rmartinc, rstancel, rstepani, sbiarozk, sdawley, simaishi, smallamp, sostapov, ssilvert, stcannon, sthorger, tbish, tcunning, thjenkin, tlavocat, tmalecek, varjain, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Bouncy Castle. A remote attacker can bypass cryptographic key-size validation by sending a crafted Cryptographic Message Syntax (CMS) message that uses key derivation. Due to an incorrect algorithm identifier comparison in the recipient handling logic, key-size verification is skipped even when explicitly enabled. This allows an attacker to supply encryption keys with unexpected or weaker key lengths, defeating security controls designed to enforce key sizes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2550731, 2550732, 2550733, 2550734, 2550735, 2550736, 2550738    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-03 08:51:23 UTC 
In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256). The branch that should have selected the actual content-encryption algorithm carried in the key derivation AlgorithmIdentifier's parameters compared the encrypted-key byte array against the id-alg-cek-hkdf-sha256 object identifier, a comparison between a byte array and an ASN1ObjectIdentifier that is false for every possible input, so the check fell through to a key-size lookup on the outer wrapper OID. That OID identifies a key-derivation construction rather than a cipher and has no registered key size, so the size comparison was skipped entirely. A key-transport EnvelopedData or AuthEnvelopedData whose transported, HKDF-derived content-encryption key did not match the key size of the advertised content-encryption algorithm was therefore accepted even with validation explicitly enabled, silently defeating the only mechanism the API offers for enforcing recovered key size. The recipient now dispatches on the content-encryption AlgorithmIdentifier's algorithm OID, so validation checks the recovered key against the inner content-encryption algorithm. Messages with a matching key size, non-HKDF messages, and recipients that do not enable validation are unaffected. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).