AIKIDO-2026-677785
bcprov-jdk18on is vulnerable to Improper Input Validation
93
Critical Risk
This Affects:
bcprov-jdk18onTL;DR
DHAgreement for the MTI/A0 Diffie-Hellman variant exponentiates the peer’s public value without validating it as a legitimate group element. A malicious peer can supply a crafted value that weakens or breaks agreement guarantees. Key agreement secrecy and authenticity assumptions fail for this DH mode. The fix validates the peer public value before exponentiation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you perform MTI/A0 Diffie-Hellman with untrusted peer public values.
Background info
bcprov-jdk18on is vulnerable to Improper Input Validation in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle provider library for your JDK target (bcprov-jdk18on, bcprov-jdk15to18 or bcprov-jdk14) to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant