{"id":"CVE-2026-8149","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-8149","summary":"Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption","details":"In Bouncy Castle LTS for Java, the AES/GCM native implementation used on Intel CPUs with AES PAA instruction sets (AVX / VAES / VAESF variants) can intermittently produce an incorrect authentication tag verification result during decryption when the ciphertext is fed in via a mix of `update()` calls followed by `doFinal()`. It is possible to work around it by either using `doFinal()` only (as the BCJSSE does) or by configuring the module to run in pure Java mode, by setting the system property \"org.bouncycastle.native.cpu_variant\" to java.","published":"2026-05-08T09:31:30Z","modified":"2026-09-10T03:50:47.153340070Z","cvss":null,"epss":{"score":0.00158,"percentile":0.05118,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-lts8on","fixedVersion":"2.73.11"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8149"},{"type":"WEB","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908149"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:47.153340070Z"}}