Improper Verification Of Cryptographic Signature

Bouncy Castle is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to OpenPGP AEAD decryption failing to verify the final authentication tag for chunk-aligned data, which allows an attacker to modify encrypted data without detection and potentially bypass...

CVE-2026-12817: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...