Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	bouncycastle	=1.80-3 \|\| >=0 <1.86-1	1.86-1
maven	org.bouncycastle:bcmls-jdk18on	>=1.78.0 <1.85.0	1.85.0
debian 13	bouncycastle	=1.80-3 \|\| =1.86-1	-
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3 \|\| =1.86-1	-

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.