CVE-2026-13506

CVE-2026-13506 affects multiple Bouncy Castle for Java lines: Java mainline prior to 1.85; Java LTS prior to 2.73.12; and Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.x), 2.0.2 (2.0.x), and 2.1.3 (2.1.x). Root cause is a Lazy ASN.1 sequence that resets the nesting-depth guard, with potential im...

CVE-2026-59649 OpenPGP user-attribute subpacket length bounded only by JVM max memory

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59652

CVE-2026-59652 affects Bouncy Castle for Java prior to 1.85, where LDAP filter injection can occur via the legacy jdk1.4 LDAPStoreHelper. The vulnerability is linked to the LDAP filter handling in that component. The provided sources do not detail exploits or exploitation status; no working explo...

CVE-2026-15055

CVE-2026-15055 affects Bouncy Castle for Java before 1.85, including LTS releases before 2.73.12, and BC-FJA before bcpkix-fips 1.0.12 (1.0.X), 2.0.12 (2.0.X), and 2.1.12 (2.1.X). Root cause: decryptors for PKCS#8 / PBES2 honour unbounded KDF cost from input. The documents do not provide explicit...