Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...