CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value
An on-path attacker can bypass key authentication and potentially recover static private keys in MTI/A0 Diffie-Hellman implementations using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63569?
CVE-2026-63569 is a critical vulnerability in Legion of the Bouncy Castle Inc. bc-csharp, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors. The attack uses a crafted out-of-range or small-order ephemeral value, and works because that value is raised to the static private key without the range and subgroup-membership checks applied to DH public keys. Only applications that call DHAgreement directly are affected.
Weakness: CWE-20
Which versions are affected by CVE-2026-63569?
It affects 1 product.
Products include Bouncycastle Bc-Csharp.
How do I fix CVE-2026-63569?
No fix has been published for CVE-2026-63569 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-63569 being exploited?
There is no known exploitation of CVE-2026-63569 in the wild and no public exploit code.
Other vulnerabilities in Legion of the Bouncy Castle Inc. bc-csharp
- CVE-2026-103600 Unbounded ASN.1 nesting depth causes process-terminating stack overflow
- CVE-2026-103603 Unbounded HSS public key level count allows huge array allocation during signature verification
- CVE-2026-103604 Quadratic-time escaping when converting X.509 distinguished names to strings
- CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used
- CVE-2026-63566 DTLS handshake reassembler allocates buffer from unchecked 24-bit length
Sources
Also known as GHSA-m2m9-m35w-rfxg.