CVE-2026-63567

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC...

CVE-2026-63569

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-63573 Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

CVE-2026-63573

A Bleichenbacher-style adaptive chosen-ciphertext attack exists in Legion of the Bouncy Castle Inc. bc-csharp versions before 2.7.0 . The vulnerability is located in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) component. Because the system rejects ciphert...

EUVD-2026-91220

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-63569

The bc-csharp library by Legion of the Bouncy Castle Inc. (versions before 2.7.0 ) is vulnerable to improper input validation in the DHAgreement.CalculateAgreement function during MTI/A0 two-pass Diffie-Hellman key exchanges. An on-path attacker can provide a crafted out-of-range or small-order e...

CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-63567 IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC...

CVE-2026-63567 IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC...

CVE-2026-63567

The bc-csharp library by Bouncy Castle Inc. is vulnerable in versions before 2.7.0 due to an observable discrepancy in IesEngine.DecryptBlock. In block-cipher mode, the engine decrypts the ciphertext and removes padding before verifying the MAC. This allows a remote attacker to perform a CBC padd...

CVE-2026-63567 IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC...

SMS4_Decrypt

SMS4Decrypt 0x01 Introduction The SMS4 algorithm is an encryption algorithm used in the WAPI wireless network standard widely adopted in China. It is a block cipher algorithm with a 32-round iterative unbalanced Feistel structure, with both key length and block length of 128. The SMS4 algorithm...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – AES-GCM Nonce Reuse Leading to Key Recovery Program Code Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def encryptplaintext: cipher = AES.newkey,...

psa-2026-00043-recovery

psa-2026-00043-recovery Recovering from a wiper that presented as ransomware, after an attack against internet-exposed Proxmox infrastructure PSA-2026-00043-1 / CVE-2023-54391. The attacker wiped guests and left the filesystems damaged. Two recovery tracks depending on what the guest was: databas...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – ECDSA Nonce Reuse in IoT Firmware Signing Program Code Python ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images with same nonce due to...

CVE-2026-11119-Padding-Oracle-Attack-on-CBC-Mode-Encryption

CVE-2026-11119 – Padding Oracle Attack on CBC Mode Encryption Program Code Python paddingoracleserver.py - Server that returns padding error from flask import Flask, request from Crypto.Cipher import AES from Crypto.Util.Padding import pad, unpad import os key = os.urandom16 app = Flaskname...

vmp2

Introduction This repository is a collection of legacy tools for working with VMProtect 2 -protected binaries. These tools enable unpacking, analysis, and experimental devirtualization of software protected with VMProtect 2. At the core of this collection is vmprofiler , a utility library that...

Scalar-Venom-Attack

This paper analyzes cryptographic vulnerabilities discovered in modern cryptographic key management infrastructure, with a particular focus on critical flaws in the architecture of hardware security modules HSMs when handling elliptic curve private keys. The study focuses on a class of attacks th...

CVE-2026-63569: Improper Input Validation

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...