Bouncy Castle Java CVE-2026-59640

Exploitation requires the target application to use Bouncy Castle's OpenPGP high-level API on the session-key/PKESK decryption path (specifically PGPSessionKeyEncryptedData or equivalent code reaching the unpatched processSymmetricEncIntegrityPacketDataStream() in the affected versions) against SEIPD v1 formatted data. The attacker must be able to submit arbitrary crafted ciphertexts to the decryption service and observe a distinguishable difference between early failure (CFB quick-check exception before MDC) and late or absent failure - making error response visibility a critical prerequisite. Applications using only password-based (PBE/SKESK) OpenPGP decryption are not vulnerable to this suppression gap, as the quick check is intentionally retained and correct on that path. Applications that have already migrated to SEIPD v2 (which lacks the legacy CFB quick-check mechanism entirely) are also not affected. The CVSS 4.0 vector PR:N indicates no authentication is required to submit ciphertexts, provided the decryption endpoint is network-accessible.

The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects a network-accessible, unauthenticated path to high confidentiality impact, which is accurate for the general exposure model but arguably overstates attack simplicity. The Mister-Zuccherato oracle attack is an adaptive-chosen-ciphertext technique requiring the adversary to submit many crafted ciphertexts to a reachable decryption service and distinguish early-failure (quick-check exception) from late-failure (MDC error) responses - this is meaningfully more complex than a trivial network exploit, and independent analysis supports AC:H. Exploitation is bounded to applications using the SEIPD v1 session-key/PKESK decryption path and exposing error distinguishability to callers. No CISA KEV listing and no public POC are known, and EPSS data was not provided in the input. The U:Amber urgency tag in the CVSS 4.0 vector signals elevated but not immediate concern. The primary risk is to applications that expose OpenPGP decryption as a network service and return granular error responses - environments using SEIPD v2 or PBE-only decryption are unaffected.

An attacker identifies a network-accessible Java service using Bouncy Castle's OpenPGP high-level API to decrypt PKESK-encrypted messages and submits a series of adaptively crafted SEIPD v1 ciphertexts, observing whether the service returns a quick-check exception (PGPDataValidationException before MDC) versus an MDC integrity failure. By iteratively refining chosen ciphertexts based on oracle responses - consistent with the Mister-Zuccherato technique - the attacker extracts plaintext bytes from intercepted legitimate encrypted messages. No public POC has been identified at time of analysis, but the attack method is documented in peer-reviewed cryptographic literature.