https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:40:29.601506+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-328516 EUVD-2026-328516 2026-10-07T03:40:29.652060+00:00 EUVD-2026-328516 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50268 fkie_cve-2026-50268 2026-10-07T03:40:29.652105+00:00

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-4j9m-h44m-2hv8 GHSA-4j9m-h44m-2hv8 — Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding 2026-10-07T03:40:29.652143+00:00

Affected: NuGet: Steeltoe.Configuration.Encryption

### Summary

Configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting.

### Impact

Operators who configure `encrypt:rsa:algorithm=OAEP` to obtain CCA2-secure padding receive PKCS#1 v1.5 instead. Currently, `Decrypt()` is called only against operator-controlled configuration data, so no exploitable path exists, but any future code path that exposes a decryption oracle would be Bleichenbacher-vulnerable despite the `OAEP` setting.

### Migration note

Existing `{cipher}` values produced under the broken `OAEP` setting were encrypted with PKCS#1 v1.5. The fix makes `OAEP` use actual OAEP padding, so those values will fail to decrypt after upgrading. Re-encrypt all affected `{cipher}` values after upgrading.