CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-103601

Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, because decryption wrote the recovered plaintext into the caller-supplied output buffer before checking the authentication tag and left it there when the check failed. Only decryption into a caller-supplied buffer is affected; methods that return a newly allocated array are not.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 22.2%

CVSS Severity

CVSS v3 Score 7.5

References

Products affected by CVE-2026-103601

Bouncycastle » Bc-Csharp » Version: N/A

cpe:2.3:a:bouncycastle:bc-csharp:-
Bouncycastle » Bc-Csharp » Version: 1.7.0

cpe:2.3:a:bouncycastle:bc-csharp:1.7.0
Bouncycastle » Bc-Csharp » Version: 1.7.0.1

cpe:2.3:a:bouncycastle:bc-csharp:1.7.0.1
Bouncycastle » Bc-Csharp » Version: 1.7.0.2

cpe:2.3:a:bouncycastle:bc-csharp:1.7.0.2
Bouncycastle » Bc-Csharp » Version: 1.8.0

cpe:2.3:a:bouncycastle:bc-csharp:1.8.0
Bouncycastle » Bc-Csharp » Version: 1.8.1

cpe:2.3:a:bouncycastle:bc-csharp:1.8.1
Bouncycastle » Bc-Csharp » Version: 1.8.10

cpe:2.3:a:bouncycastle:bc-csharp:1.8.10
Bouncycastle » Bc-Csharp » Version: 1.8.2

cpe:2.3:a:bouncycastle:bc-csharp:1.8.2
Bouncycastle » Bc-Csharp » Version: 1.8.3

cpe:2.3:a:bouncycastle:bc-csharp:1.8.3
Bouncycastle » Bc-Csharp » Version: 1.8.4

cpe:2.3:a:bouncycastle:bc-csharp:1.8.4
Bouncycastle » Bc-Csharp » Version: 1.8.5

cpe:2.3:a:bouncycastle:bc-csharp:1.8.5
Bouncycastle » Bc-Csharp » Version: 1.8.6

cpe:2.3:a:bouncycastle:bc-csharp:1.8.6
Bouncycastle » Bc-Csharp » Version: 1.8.7

cpe:2.3:a:bouncycastle:bc-csharp:1.8.7
Bouncycastle » Bc-Csharp » Version: 1.8.8

cpe:2.3:a:bouncycastle:bc-csharp:1.8.8
Bouncycastle » Bc-Csharp » Version: 1.8.9

cpe:2.3:a:bouncycastle:bc-csharp:1.8.9
Bouncycastle » Bc-Csharp » Version: 1.9.0

cpe:2.3:a:bouncycastle:bc-csharp:1.9.0
Bouncycastle » Bc-Csharp » Version: 2.0.0

cpe:2.3:a:bouncycastle:bc-csharp:2.0.0
Bouncycastle » Bc-Csharp » Version: 2.1.0

cpe:2.3:a:bouncycastle:bc-csharp:2.1.0
Bouncycastle » Bc-Csharp » Version: 2.1.1

cpe:2.3:a:bouncycastle:bc-csharp:2.1.1
Bouncycastle » Bc-Csharp » Version: 2.2.0

cpe:2.3:a:bouncycastle:bc-csharp:2.2.0
Bouncycastle » Bc-Csharp » Version: 2.2.1

cpe:2.3:a:bouncycastle:bc-csharp:2.2.1
Bouncycastle » Bc-Csharp » Version: 2.3.0

cpe:2.3:a:bouncycastle:bc-csharp:2.3.0
Bouncycastle » Bc-Csharp » Version: 2.3.1

cpe:2.3:a:bouncycastle:bc-csharp:2.3.1
Bouncycastle » Bc-Csharp » Version: 2.4.0

cpe:2.3:a:bouncycastle:bc-csharp:2.4.0
Bouncycastle » Bc-Csharp » Version: 2.5.0

cpe:2.3:a:bouncycastle:bc-csharp:2.5.0
Bouncycastle » Bc-Csharp » Version: 2.5.1

cpe:2.3:a:bouncycastle:bc-csharp:2.5.1
Bouncycastle » Bc-Csharp » Version: 2.6.0

cpe:2.3:a:bouncycastle:bc-csharp:2.6.0
Bouncycastle » Bc-Csharp » Version: 2.6.1

cpe:2.3:a:bouncycastle:bc-csharp:2.6.1
Bouncycastle » Bc-Csharp » Version: 2.6.2

cpe:2.3:a:bouncycastle:bc-csharp:2.6.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-103601

Products

Pricing

Contact Us