Vulnerability · Published Oct 2, 2026 · Assigned by bcorg
CVE-2026-15999AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication
High 8.2
In plain English
A high-severity security flaw in bc-csharp from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declare an authentication tag (aes-ICVlen) of zero or another length outside the RFC 5084 set, because CcmParameters accepted any value and CcmBlockCipher validated the tag length only when encrypting, so decryption compared a zero-length or very short tag. Affected paths include ParameterUtilities.GetCipherParameters, used by CmsEnvelopedData and CmsEnvelopedDataParser for EnvelopedData encrypted with AES-CCM, and any caller passing an unchecked tag length to CcmBlockCipher for decryption.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Legion of the Bouncy Castle Inc. | bc-csharp | 0 – before 2.7.0 |
Weakness: CWE-354 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N