# cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

cryptography's PKCS#7 EnvelopedData decryption returned distinguishable errors and timing for RSA padding, key length, and AES padding failures, giving a Bleichenbacher oracle on the content-encryption key.

- Payout: Research
- Severity: high
- Program: cryptography
- Found by: X1AOxiang
- Disclosed: 2026-08-03
- CVE: CVE-2026-69247
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-g6cj-pr64-35w5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-g6cj-pr64-35w5
- Tags: area:oss domain:oss impact:data-leak kind:research platform:ghsa sev:high tech:python technique:source-review vuln:crypto vuln:info-disclosure vuln:oracle-manipulation

**Target:** Python cryptography library PKCS#7 EnvelopedData decryption (pkcs7_decrypt_der/pem/smime)
**Root cause:** Decryption stages (RSA PKCS#1 v1.5 decrypt, AES key-length check, AES-CBC unpad) each failed with distinct error messages and timing, with no RFC 3218 implicit-rejection mitigation, leaking whether RSA padding was valid and the recovered key length.
**Steps:**
1. Feed attacker-crafted EnvelopedData matching the victim certificate to a service that auto-decrypts and reflects the outcome.
2. Observe error class: `Decryption failed` = invalid RSA padding; `Invalid key size (N) for AES.` = valid padding with disclosed length N; `Invalid padding bytes.` = correct length, wrong key.
3. Use the distinguishable outcomes (and timing) adaptively at high volume to build a Bleichenbacher oracle against the content-encryption key.
4. Note case 1 only reachable on backends lacking implicit rejection: OpenSSL 3.0/3.1, LibreSSL, BoringSSL.
**How found:** Code reading of the decrypt path: RSA PKCS#1 v1.5 decrypt → AES cipher build → AES-CBC decrypt/unpad, noticing each stage surfaced a different error and that the key-length error disclosed N, plus a timing side channel.
**Exploitation:** Requires a service (e.g. S/MIME gateway or mail filter) that auto-decrypts untrusted EnvelopedData for the victim cert and answers adaptively at high volume; the oracle distinguishes RSA padding validity and key length to recover the content-encryption key.
**Insight:** When auditing PKCS#7/CMS decryptors, enumerate every distinct error string and code path between RSA unpad, key-length validation and CBC unpad; a key-size error that echoes the recovered length is a direct Bleichenbacher distinguisher, and RFC 3218 requires resolving the CEK algorithm before touching the private key.