PT-2026-55358 · Nuget · Steeltoe.Configuration.Encryption

Published 2026-07-02 · Updated 2026-07-02

OSV

CVSS v3.1

1.9

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Summary

Configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the OAEP setting selects PKCS#1 v1.5, which is the same algorithm as the DEFAULT setting.

Impact

Operators who configure encrypt:rsa:algorithm=OAEP to obtain CCA2-secure padding receive PKCS#1 v1.5 instead. Currently, Decrypt() is called only against operator-controlled configuration data, so no exploitable path exists, but any future code path that exposes a decryption oracle would be Bleichenbacher-vulnerable despite the OAEP setting.

Migration note

Existing {cipher} values produced under the broken OAEP setting were encrypted with PKCS#1 v1.5. The fix makes OAEP use actual OAEP padding, so those values will fail to decrypt after upgrading. Re-encrypt all affected {cipher} values after upgrading.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-256

CWE-327

Related Identifiers

GHSA-4J9M-H44M-2HV8

Affected Products

Steeltoe.Configuration.Encryption

References · 5

• https://osv.dev/vulnerability/GHSA-4j9m-h44m-2hv8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50268 · Security Note
• https://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b · Note
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8 · Note
• https://github.com/SteeltoeOSS/security-advisories · Note