Vulnerability · Published May 8, 2026 · Assigned by bcorg
CVE-2026-8149GCM chunking can lead to bad tag exception on decryption
Medium 5.1
In plain English
A medium-severity security flaw in BC-FJA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f. This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C. This issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.bouncycastle:bcprov-lts8on | 2.73.11 | GHSA-mx76-r943-rf8g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-LTS | 2.73.0 – before 2.73.11 |
| Legion of the Bouncy Castle Inc. | BC-FJA | 2.1.0 – before 2.1.3 |
Weakness: CWE-1068 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:N/RE:M/U:Amber