Bouncy Castle For Java Lts

bouncy_castle_for_java_lts

Vendor: Bouncycastle • 28 CVEs

CVEs (28)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-59645 1Bouncycastle 3Bc Java Bcutil FipsBouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (B...Show more In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).Show less
CVE-2026-59642 1Bouncycastle 3Bc Java Bcpkix FipsBouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) be...Show more In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).Show less
CVE-2026-59641 1Bouncycastle 4Bc Java Bcjmail FipsBcmail Fips+1 more Aug 28, 2026 Aug 3, 2026 8.7 HIGH· v4 5.3 MEDIUM· v3 N/A· v2 In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA)...Show more In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).Show less
CVE-2026-59640 1Bouncycastle 3Bc Java Bcpg FipsBouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 8.7 HIGH· v4 5.3 MEDIUM· v3 N/A· v2 In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) bef...Show more In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).Show less
CVE-2026-59639 1Bouncycastle 3Bc Java Bcpkix FipsBouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) befor...Show more In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).Show less
CVE-2026-59638 1Bouncycastle 3Bc Java Bctls FipsBouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 9.3 CRITICAL· v4 6.5 MEDIUM· v3 N/A· v2 In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (...Show more In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).Show less
CVE-2026-15055 1Bouncycastle 3Bc Java Bcpkix FipsBouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 5.3 MEDIUM· v4 8.2 HIGH· v3 N/A· v2 In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc...Show more In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).Show less
CVE-2026-12185 1Bouncycastle 2Bc Java Bouncy Castle For Java Lts Aug 28, 2026 Aug 3, 2026 7.1 HIGH· v4 8.6 HIGH· v3 N/A· v2 In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Previous 12