GHSA-mx76-r943-rf8g

Suggest an improvement
Source
https://github.com/advisories/GHSA-mx76-r943-rf8g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mx76-r943-rf8g/GHSA-mx76-r943-rf8g.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mx76-r943-rf8g
Aliases
  • CVE-2026-8149
Downstream
Published
2026-05-08T09:31:30Z
Modified
2026-07-17T21:09:13.674669602Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption
Details

In Bouncy Castle LTS for Java, the AES/GCM native implementation used on Intel CPUs with AES PAA instruction sets (AVX / VAES / VAESF variants) can intermittently produce an incorrect authentication tag verification result during decryption when the ciphertext is fed in via a mix of update() calls followed by doFinal(). It is possible to work around it by either using doFinal() only (as the BCJSSE does) or by configuring the module to run in pure Java mode, by setting the system property "org.bouncycastle.native.cpu_variant" to java.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1068",
        "CWE-354"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2026-05-08T07:16:29Z",
    "github_reviewed_at": "2026-05-14T13:06:27Z"
}
References

Affected packages

Maven / org.bouncycastle:bcprov-lts8on

Package

Name
org.bouncycastle:bcprov-lts8on
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-lts8on

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.73.0
Fixed
2.73.11

Affected versions

2.*
2.73.0
2.73.1
2.73.2
2.73.3
2.73.4
2.73.5
2.73.6
2.73.7
2.73.8
2.73.9
2.73.10

Database specific

last_known_affected_version_range 
"<= 2.73.10"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mx76-r943-rf8g/GHSA-mx76-r943-rf8g.json"