Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a blo...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk16 is a Bouncy Castle Crypto package that is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6. Affected versions of this package are vulnerable to Improper...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a...

CVE-2026-12816

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

EUVD-2026-52135

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12816

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12816

Bouncy Castle for Java contains an IESEngine stream-mode MAC forgery flaw via a length-dependent KDF split, affecting versions before 1.85 (and Bouncy Castle for Java LTS before 2.73.12). The issue is documented in CVE-2026-12816 with no exploitation details provided in the supplied sources. No r...

CVE-2026-12816: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

PT-2026-67017

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

MGASA-2026-0071 Updated nodejs packages fix security vulnerabilities

Incomplete fix for CVE-2026-21637: loadSNI in tlswrap.js lacks try/catch leading to Remote DoS. CVE-2026-21637 Denial of Service via proto header name in req.headersDistinct Uncaught TypeError crashes Node.js process. CVE-2026-21710 Timing side-channel in HMAC verification via memcmp in...

Observable Timing Discrepancy

Overview Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the cryptohmac.cc module using memcmp, a non-constant-time comparison function to validate user-provided HMAC signatures, rather than the timing-safe equivalents used elsewhere in the codebase. An...

Node.js: Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery

Vulnerability description not provided...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002454)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002454 advisory. The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003094 advisory. The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to...