CVE-2016-1000346: Insecure Validation of DH Public Key in Bouncy Castle JCE Provider
Summary
CVE-2016-1000346: In Bouncy Castle JCE Provider the other party DH public key is not fully validated. Affects org.bouncycastle:bcprov-jdk14 versions < 1.56. Fixed in 1.56. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2016-1000346 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bouncy Castle JCE Provider is a Java library that provides cryptographic services. It includes implementations of various cryptographic algorithms, including Diffie-Hellman (DH) key exchange. DH is a method of securely exchanging cryptographic keys over an insecure channel. The Bouncy Castle JCE Provider version 1.55 and earlier are affected by a vulnerability where the other party's DH public key is not fully validated. This can lead to the disclosure of details about the other party's private key when static Diffie-Hellman is used.
Vulnerability Detail
The vulnerability in the Bouncy Castle JCE Provider arises from the lack of complete validation of the other party's DH public key. This means that an attacker can use an invalid key to obtain information about the other party's private key. This can have serious consequences, as it compromises the security of the key exchange process and can lead to unauthorized access to encrypted data. The issue was addressed in version 1.56 of the library, where the key parameters are now properly checked during the agreement calculation.
How To Fix
Latest published version: 1.86 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.56
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the library to the fixed version.
Conclusion
The Bouncy Castle JCE Provider version 1.55 and earlier are vulnerable to an insecure validation of the other party's DH public key. This can lead to the disclosure of private key information and compromise the security of the key exchange process. To mitigate this vulnerability, it is crucial to update the library to version 1.56 or later. For additional support, please contact DevNack.com.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
This vulnerability allows an attacker to obtain information about the other party's private key during a key exchange process. This can lead to unauthorized access to encrypted data and compromise the security of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it and alert you if any vulnerable versions of the Bouncy Castle JCE Provider library are detected.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to update the library to the fixed version to prevent any potential exploitation.
No, manual validation of the DH public key is not recommended as it requires a deep understanding of the cryptographic algorithms and their implementation. It is best to rely on the fixed version of the library, which includes proper validation of the key parameters.
For further support on vulnerability remediation and assistance with updating the Bouncy Castle JCE Provider library, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
