Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

🗓️ 08 Aug 2026 03:31:12Reported by GitHub Advisory DatabaseType

BC-FJA key zeroisation via finalization risks OOM and prolonged heap retention of key material.

Reporter	Title	Published	Views	Family All 87
IBM Security Bulletins	Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars	1 Oct 202614:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	9 Oct 202604:46	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	28 Sep 202614:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS	23 Sep 202605:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Bouncy Castle cryptographic libraries, IBM EntireX is vulnerable to multiple vulnerabilities.	22 Sep 202612:30	–	ibm
attackerkb	CVE-2026-13505	8 Aug 202600:59	–	attackerkb
Chainguard	CVE-2026-13505 vulnerabilities	5 Aug 202620:22	–	cgr
CVE	CVE-2026-13505	8 Aug 202600:59	–	cve
Cvelist	CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization	8 Aug 202600:59	–	cvelist
EUVD	EUVD-2026-54726	8 Aug 202600:59	–	euvd

Vulners

Node

org.bouncycastle bc-fipsRange2.1.0–2.1.3maven

org.bouncycastle bc-fipsRange2.0.0–2.0.2maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-13505
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505
github	www.github.com/advisories/GHSA-98j2-6v39-78w8

18 Sep 2026 17:37Current

6Medium risk

Vulners AI Score6

CVSS 48.7

EPSS0.00253

SSVC