CVE-2026-15999

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-15999
Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declare an authentication tag (aes-ICVlen) of zero or another length outside the RFC 5084 set, because CcmParameters accepted any value and CcmBlockCipher validated the tag length only when encrypting, so decryption compared a zero-length or very short tag. Affected paths include ParameterUtilities.GetCipherParameters, used by CmsEnvelopedData and CmsEnvelopedDataParser for EnvelopedData encrypted with AES-CCM, and any caller passing an unchecked tag length to CcmBlockCipher for decryption.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/bcgit/bc-csharp/commit/2818bdfa55efd58b0d6a1c75f360b8404d879780 Patch
https://github.com/bcgit/bc-csharp/commit/9d284d8f379614def853b590c62bbb31c48f7af0 Patch
https://github.com/bcgit/bc-csharp/wiki/CVE-2026-15999 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bouncycastle:bc-csharp:*:*:*:*:*:*:*:*
History

27 Oct 2026, 16:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:bouncycastle:bc-csharp:*:*:*:*:*:*:*:*
References () https://github.com/bcgit/bc-csharp/commit/2818bdfa55efd58b0d6a1c75f360b8404d879780 - () https://github.com/bcgit/bc-csharp/commit/2818bdfa55efd58b0d6a1c75f360b8404d879780 - Patch
References () https://github.com/bcgit/bc-csharp/commit/9d284d8f379614def853b590c62bbb31c48f7af0 - () https://github.com/bcgit/bc-csharp/commit/9d284d8f379614def853b590c62bbb31c48f7af0 - Patch
References () https://github.com/bcgit/bc-csharp/wiki/CVE-2026-15999 - () https://github.com/bcgit/bc-csharp/wiki/CVE-2026-15999 - Patch, Vendor Advisory
First Time Bouncycastle bc-csharp
Bouncycastle

02 Oct 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-02 07:16

Updated : 2026-10-27 16:34

NVD link : CVE-2026-15999

Mitre link : CVE-2026-15999

CVE.ORG link : CVE-2026-15999

JSON object : View

Products Affected

bouncycastle

  • bc-csharp
CWE
CWE-354

Improper Validation of Integrity Check Value