CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller’s output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, reducing CCM to an unauthenticated CTR decryption oracle.