{"id":"CVE-2026-8149","aliases":["EUVD-2026-28534","GHSA-mx76-r943-rf8g"],"status":"published","title":"GCM chunking can lead to bad tag exception on decryption","description":"A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f.\n\n This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.\n\n\n\nThis issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:N/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00158,"percentile":0.04953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1068","CWE-354"],"published":"2026-05-08T06:01:40Z","modified":"2026-10-26T19:10:00Z","fixes":[{"ecosystem":"Maven","package":"org.bouncycastle:bcprov-lts8on","fixed_in":["2.73.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.bouncycastle:bcprov-lts8on","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.73.0"},{"last_affected":"2.73.10"},{"fixed":"2.73.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.bouncycastle:bcprov-lts8on","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.73.0"},{"fixed":"2.73.11"}]}],"versions":["2.73.0","2.73.1","2.73.10","2.73.2","2.73.3","2.73.4","2.73.5","2.73.6","2.73.7","2.73.8","2.73.9"]}],"products":[{"vendor":"legion of the bouncy castle inc.","product":"bc-fja"},{"vendor":"legion of the bouncy castle inc.","product":"bc-lts"}],"references":[{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908149","tags":["vendor-advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8149","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mx76-r943-rf8g"}],"sources":{"cve":[{"id":"CVE-2026-8149","title":"GCM chunking can lead to bad tag exception on decryption","description":"A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f.\n\n This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.\n\n\n\nThis issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.","status":"published","published":"2026-05-08T06:01:40.875Z","modified":"2026-07-21T04:59:54.559Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:N/RE:M/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-1068"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-28534","description":"A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f.\n\n This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.\n\n\n\nThis issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.","status":"published","published":"2026-05-08T06:01:40Z","modified":"2026-07-21T04:59:54Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:N/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-mx76-r943-rf8g","title":"Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption","description":"In Bouncy Castle LTS for Java, the AES/GCM native implementation used on Intel CPUs with AES PAA instruction sets (AVX / VAES / VAESF variants) can intermittently produce an incorrect authentication tag verification result during decryption when the ciphertext is fed in via a mix of `update()` calls followed by `doFinal()`. It is possible to work around it by either using `doFinal()` only (as the BCJSSE does) or by configuring the module to run in pure Java mode, by setting the system property \"org.bouncycastle.native.cpu_variant\" to java.","status":"published","published":"2026-05-08T09:31:30Z","modified":"2026-07-07T21:30:16Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-354","CWE-1068"],"updated_at":"2026-11-02T14:40:40.389795Z"}],"nvd":[{"id":"CVE-2026-8149","description":"A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f.\n\n This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.\n\n\n\nThis issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.","status":"published","published":"2026-05-08T07:16:29.603Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:M/U:Amber","level":"medium","assessor":"secondary"}],"cwes":["CWE-1068"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"GHSA-mx76-r943-rf8g","title":"Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption","description":"In Bouncy Castle LTS for Java, the AES/GCM native implementation used on Intel CPUs with AES PAA instruction sets (AVX / VAES / VAESF variants) can intermittently produce an incorrect authentication tag verification result during decryption when the ciphertext is fed in via a mix of `update()` calls followed by `doFinal()`. It is possible to work around it by either using `doFinal()` only (as the BCJSSE does) or by configuring the module to run in pure Java mode, by setting the system property \"org.bouncycastle.native.cpu_variant\" to java.","status":"published","published":"2026-05-08T09:31:30Z","modified":"2026-09-10T03:50:47.15334007Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1068","CWE-354"],"updated_at":"2026-11-02T15:46:52.534897Z"}]}}