CVE-2026-15055

🗓️ 03 Aug 2026 01:16:43Reported by [email protected]Type

CVE-2026-15055 allows unbounded KDF cost in PKCS#8 PBES2 decryptors of Bouncy Castle Java before 1.85; affects long term support before 2.73.12 and FIPS before 1.0.12, 2.0.12, 2.1.12.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026	31 Aug 202610:29	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle vulnerabilities that could cause denial of service, resource exhaustion, cryptographic verification bypass, or other security impacts.	3 Sep 202613:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring, Tomcat, Netty, PostCSS might affect IBM Storage Protect Plus	9 Sep 202613:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java	9 Sep 202604:41	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java	8 Sep 202614:56	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service	24 Aug 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to issues like Memory allocation, verification and validation issues due to the use of Bouncy Castle for Java (CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860 are some of the example CVEs).	12 Sep 202615:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	27 Aug 202606:11	–	ibm

NVD

Node

bouncycastle bc-javaRange<1.85

bouncycastle bcpkix-fipsRange<1.0.12

bouncycastle bcpkix-fipsRange2.0.7–2.0.12

bouncycastle bcpkix-fipsRange2.1.8–2.1.12

bouncycastle bouncy_castle_for_java_ltsRange≤2.73.11

Source	Link
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9015055
github	www.github.com/bcgit/bc-java/commit/7ab4ee67a0135950001b29b41a96d8a9a5d3b68b

28 Aug 2026 15:04Current

CVSS 3.18.2

CVSS 45.3

EPSS0.0027

CWE-770