CVE-2026-59650: CWE-20 Improper Input Validation in Legion of the Bouncy Castle Inc. BC-JAVA radar.offseq.com
CVE page on BC-JAVA’s MTI/A0 DH bug, where an unvalidated peer value gets exponentiated in pre-1.85 and LTS <2.73.12.
3 comments
Does MTI/A0 assume the peer value is already in the right subgroup, or is there supposed to be an explicit validation step before the exponentiation?
Validation first, yes, unlike X25519's cofactor clearing, BC-JAVA seems to trust raw peer values.
> Validation first, yes, unlike X25519's cofactor clearing, BC-JAVA seems to trust raw peer values.
I think that comparison is a bit off, because X25519's ladder is designed around a fixed prime-order subgroup, so