CVE-2026-63569
Received Received - Intake

Improper Input Validation in Bouncy Castle bc-csharp

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: bcorg

Description
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors. The attack uses a crafted out-of-range or small-order ephemeral value, and works because that value is raised to the static private key without the range and subgroup-membership checks applied to DH public keys. Only applications that call DHAgreement directly are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-63569
EUVD
EUVD-2026-91220

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
legion_of_the_bouncy_castle_inc bc-csharp to 2.7.0 (exc)
legion_of_the_bouncy_castle_inc bc-csharp to 2.7.0-beta.98 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63569 is an improper input validation flaw in the DHAgreement.CalculateAgreement method of the Bouncy Castle C# library. It affects the MTI/A0 two-pass Diffie-Hellman key agreement protocol. The issue occurs because the method does not validate the peer's ephemeral value, allowing an attacker to manipulate it. This can either force the key agreement to a known value or extract the local static private key, especially when p-1 has many small factors.

Detection Guidance

To detect this vulnerability, check if your system uses Bouncy Castle's bc-csharp library versions 2.6.2 or earlier, or 2.7.0-beta.98. Inspect the DHAgreement class for improper input validation in CalculateAgreement. Look for applications calling DHAgreement directly without validating ephemeral values.

Impact Analysis

This vulnerability allows an on-path attacker to compromise the key authentication provided by the MTI/A0 protocol. It can also enable an attacker to recover the local static private key if the private key is reused. Applications directly calling DHAgreement are affected, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability primarily impacts cryptographic security in applications using the Bouncy Castle library. While it does not directly violate GDPR or HIPAA, it could lead to unauthorized data access if exploited, potentially compromising encrypted communications or stored data. Compliance may be affected if the vulnerability results in data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade to bc-csharp version 2.7.0 or later. If upgrading is not possible, manually validate ephemeral values before calling CalculateAgreement. Ensure peer-supplied values are within the valid range (2 to p-2) and in the prime-order subgroup. Reject weak values like 1 or p-1.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart