CVE-2026-71883

{
  "etk_id": "ETK-2026-441",
  "cve_id": "CVE-2026-71883",
  "display_id": "CVE-2026-71883",
  "ghsa_id": "GHSA-f5wg-4mfp-h458",
  "euvd_id": "EUVD-2026-91992",
  "status": "published",
  "anchor_state": "anchored",
  "title": "In-place encryption key disclosure in bcprov-lts8on",
  "summary": "bcprov-lts8on versions before 2.73.13 can expose encryption key material when using affected one-shot native cipher operations. An attacker able to trigger an application to encrypt into the same array used for its key may cause the application to store or send that key instead of ciphertext, on JVMs that copy JNI arrays.",
  "mitigation": "Upgrade bcprov-lts8on to version 2.73.13 or later. Until upgraded, do not use a key, IV, or authenticated-data array as an encryption output buffer; use separate buffers or unaffected cipher paths.",
  "vendor": "Legion of the Bouncy Castle Inc.",
  "product": "BC-LTS-JAVA",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.73.4, < 2.73.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.73.13"
      ],
      "package_name": "bcprov-lts8on",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber",
  "epss_score": 0.0025,
  "epss_percentile": 0.1575,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 17.965651266666665,
  "t0_at": "2026-10-03T08:38:18.749000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T11:08:04.707197+00:00",
      "days": 0.10400414579861111,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T08:38:18.749000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T08:38:18.749000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T08:38:18.749000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71883"
    }
  }
}