CVE-2026-63573

The record

Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.

Affected packages

Related vulnerabilities

• CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a… CWE-203
• CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted… CWE-203
• CVE-2026-114064 Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook… CWE-203
• CVE-2026-111933 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before… CWE-203
• CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <=… CWE-203
• CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to… CWE-203
• CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
• CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. CWE-203