Bouncy Castle LTS CVE-2026-71884

Exploitation requires that the application use the BC LTS Java native one-shot CTR packet cipher path specifically, configured with an IV of 13, 14, or 15 bytes (leaving only a 1-, 2-, or 3-byte block counter addressing 256 / 65536 / 16777216 blocks), AND that it pass a single input longer than that counter space so the counter wraps and the keystream repeats within the packet. The attacker must additionally obtain the produced ciphertext to mount the two-time-pad recovery. Exploitation is NOT possible against: full 16-byte IVs (counter range is the caller's responsibility), counters of 4 bytes or more (cannot be exhausted by a Java int length), the streaming implementation (validates at init and during processing), the portable AESCTRPacketCipher (rejects with 'Counter in CTR/SIC mode out of range'), or the bcprov distribution (ships no native code). These limiting factors mean only non-default short-IV native deployments are realistically affected.

The input CVSS 4.0 base score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N - a pure confidentiality impact (VC:H) with no integrity or availability effect, consistent with CWE-323 (nonce/keystream reuse). The AT:P flag is the critical qualifier: exploitation carries a specific attack requirement, namely that the victim application invokes the native one-shot CTR packet cipher with a 13-15 byte IV AND supplies an input longer than the shrunken counter can address. No EPSS probability, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. These signals point to a genuine cryptographic flaw whose real-world risk is substantially lower than the 8.2 headline for the typical deployment, because it is gated by a non-default usage pattern (short IV + over-long single-shot input over the native path) rather than being broadly reachable; the description itself notes the streaming path, the portable AESCTRPacketCipher, full 16-byte IVs, and the entire bcprov distribution are all unaffected. Treat as a high-priority fix for environments confirmed to use the BC LTS native one-shot CTR path with short IVs, but as lower practical urgency elsewhere. Note: no EPSS was provided, so exploitation-probability cannot be weighed against the CVSS score.

An application uses Bouncy Castle for Java LTS (native one-shot CTR packet cipher) with a 13-byte IV and encrypts a packet larger than the ~256-block counter space; the 1-byte counter wraps and the keystream repeats within the same packet, yet the call returns success and the full length. An attacker who obtains only the resulting ciphertext XORs the two segments encrypted under the identical keystream (a classic two-time pad) and recovers both plaintexts without ever possessing the key. No public POC was identified in the supplied data.