CVE-2026-13505

🗓️ 08 Aug 2026 00:59:40Reported by bcorgType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 147 Views

BC-FJA used finalizers to zeroise sensitive keys; Java nine+ uses Cleaner; BCprov and LTS unaffected.

Reporter	Title	Published	Views	Family All 85
IBM Security Bulletins	Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars	1 Oct 202614:44	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	28 Sep 202614:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS	23 Sep 202605:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Bouncy Castle cryptographic libraries, IBM EntireX is vulnerable to multiple vulnerabilities.	22 Sep 202612:30	–	ibm
attackerkb	CVE-2026-13505	8 Aug 202600:59	–	attackerkb
Chainguard	CVE-2026-13505 vulnerabilities	5 Aug 202620:22	–	cgr
Cvelist	CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization	8 Aug 202600:59	–	cvelist
EUVD	EUVD-2026-54726	8 Aug 202600:59	–	euvd
Github Security Blog	Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.	8 Aug 202603:31	–	github
NVD	CVE-2026-13505	8 Aug 202602:17	–	nvd

[
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "BC-FJA",
    "platforms": [
      "all"
    ],
    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
    "packageName": "bc-fips",
    "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
    "programFiles": [
      "SymmetricSecretKey",
      "SecretZeroizer",
      "AESWorkingBuffer",
      "DESedeWorkingBuffer",
      "HashDRBGWorkingBuffer",
      "HMacDRBGWorkingBuffer",
      "CTRDRBGWorkingBuffer"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "1.0.2.7",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.2",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "2.1.0",
        "lessThan": "2.1.3",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505

03 Sep 2026 16:44Current

6Medium risk

Vulners AI Score6

CVSS 48.7

EPSS0.00253

SSVC

CWE-772