CVE-2026-12803 is a high severity cryptographic flaw (CVSS 7.5) in Bouncy Castle for Java. KCCMBlockCipher, the DSTU 7624 CCM mode, leaves the nonce out of its MAC when no associated data is supplied, which allows forged messages. Fixed in 1.85 and LTS 2.73.12.
What's affected
- Bouncy Castle for Java (bc-java) before 1.85, and the LTS line (bc-java LTS) before 2.73.12. Java 8 and later.
- Component: KCCMBlockCipher.
- Fixed: bc-java 1.85 and bc-java LTS 2.73.12. The record lists two fix commits.
The Bouncy Castle advisory page gives no CVSS score or rating. The score here is the CVE record's: 7.5 High (integrity impact only).
How to check if you're exposed
Bouncy Castle usually arrives as a transitive dependency, so start with the dependency tree rather than your own build file.
mvn dependency:tree -Dincludes=org.bouncycastle
gradle dependencies --configuration runtimeClasspath | grep -i bouncycastle
If you ship a fat jar or a container image, look inside the artifact too, because shaded copies do not show up in a dependency tree.
unzip -l app.jar | grep org/bouncycastle
Compare what you find with the fixed versions above. Search your code for KCCMBlockCipher or DSTU 7624 usage. If you never use that mode, the practical exposure is low, but you should still upgrade with the rest of the library.
Paste your manifest into the free in-browser dependency scan to see whether an affected version is in your tree. Nothing needs to be installed.
What to do now
- Find every Bouncy Castle copy in your build, including shaded and bundled ones.
- Upgrade to the fixed version for the line you use, listed above.
- Rebuild and redeploy, then confirm the new version with the same commands.
- Check whether you use the DSTU 7624 CCM mode (KCCMBlockCipher) at all. Most applications do not.
Why it matters
The weakness is CWE-354 (Improper Validation of Integrity Check Value). In the affected mode, the method that folds the nonce into the MAC only runs when associated data is present. With none supplied, the tag depends on the key and plaintext, not the nonce. The advisory page says an attacker with an encryption oracle can produce valid ciphertext and tag pairs for combinations never queried, which it describes as fully breaking authenticity.
A good AEAD mode must bind every input, including the nonce, to the tag. A missing code path on an edge case, here no associated data, is exactly where such bugs hide. The record does not list the CVE as exploited, and the mode is niche. Still, a forged message that passes authentication defeats the reason for using AEAD.
Quick check
Who uses KCCMBlockCipher?
It implements the DSTU 7624 CCM mode, a national standard cipher mode. Few applications use it.
Is there a workaround?
The advisory lists none. Upgrade.
Sources
Last reviewed: 18 October 2026.
