CVE-2026-50268: Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

July 2, 2026

Configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the OAEP setting selects PKCS#1 v1.5, which is the same algorithm as the DEFAULT setting.

References

github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b
github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8
github.com/advisories/GHSA-4j9m-h44m-2hv8
nvd.nist.gov/vuln/detail/CVE-2026-50268

Code Behaviors & Features

Detect and mitigate CVE-2026-50268 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →