Bouncy Castle Java CVE-2026-12860

Exploitation requires that the target application uses Bouncy Castle's RSADigestSigner for RSA PKCS#1 v1.5 signature verification AND that the signer or signing library producing the signatures being verified uses the legacy NULL-omitted AlgorithmIdentifier encoding in DigestInfo (rather than the RFC 8017-compliant NULL-present encoding). The vulnerability is entirely absent from the strict NULL-present DigestInfo path (the common case), which uses a full constant-time array comparison. Additionally, if the system property org.bouncycastle.pkcs1.strict_digestinfo is set to true, the NULL-omitted form is rejected outright and this path is never reached. Exploitation is further constrained to contexts where an attacker can supply arbitrary signatures for verification - such as JWT token submission, TLS client certificate presentation, or application-layer RSA signature acceptance - limiting risk to exposed verification endpoints or services.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VI:H reflects unauthenticated remote exploitation with high integrity impact and no confidentiality or availability impact. The AT:N designation in the supplied vector implies no special attack requirements, though the vulnerability is only reachable via the NULL-omitted DigestInfo code path, which is not the default in all contexts - an independent assessment would place this at AT:P. No EPSS data or CISA KEV listing is provided in the source data. The CVE tags include 'Jwt Attack', signaling particular risk for applications using Bouncy Castle to verify RSA-signed JWTs, where a forged token could allow unauthorized authentication or privilege escalation. The public patch commit at ea5970ea9b2fb91d763b904692fd21089ca3e396 includes a runnable test that demonstrates exactly how to craft the forged DigestInfo structure, making practical exploit development straightforward for a knowledgeable attacker. Overall this is a high real-world priority for any organization using Bouncy Castle for RSA PKCS#1 v1.5 signature verification in security-critical flows, particularly JWT and certificate handling.

An attacker targets a Java application using Bouncy Castle to verify RSA-signed JWTs. The attacker computes the SHA-256 hash of their target message, flips the final two hash bytes, encodes this in a NULL-omitted DigestInfo structure, and generates an RSA signature over the forged structure. When submitted, the Bouncy Castle verifier's loop exits two bytes early, misses the altered bytes, and accepts the forged signature - granting the attacker a valid token accepted by the server.