Atlassian Jira Service Management Data Center and Server < 10.3.25 / 11.3.x < 11.3.11 (JSDSERVER-16832)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16832 advisory. - In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 IF1 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the...

CLEANSTART-2026-MV07927 In Bouncy Castle for Java before 1

CVE-2026-18040 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-TA59206 In Bouncy Castle for Java before 1

CVE-2026-97873 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-KF30791 In Bouncy Castle for Java before 1

CVE-2026-71891 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-HE64068 In Bouncy Castle for Java before 1

CVE-2026-71892 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-MO96891 In Bouncy Castle for Java before 1

CVE-2026-17508 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-NB89107 In Bouncy Castle for Java before 1

CVE-2026-18036 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-LI97281 In Bouncy Castle for Java before 1

CVE-2026-71889 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-EM43415 In Bouncy Castle for Java before 1

CVE-2026-71888 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-RU76121 In Bouncy Castle for Java before 1

CVE-2026-85515 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.327 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with...

Improper Input Validation

Bouncy Castle for Java is vulnerable to Improper Input Validation. The vulnerability is due to the MTI/A0 Diffie-Hellman agreement process exponentiating unvalidated peer-supplied values without range or subgroup-membership checks, which allows a malicious peer to recover the local static private...

SUSE CVE-2026-71884

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

CVE-2026-71884

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

CVE-2026-71884

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

CVE-2026-71884 Packet CTR reports a full success length after the counter is exhausted

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

EUVD-2026-95586

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

CVE-2026-71884

In Bouncy Castle for Java LTS versions before 2.73.13 , a vulnerability exists in the native one-shot CTR packet cipher . The component fails to verify if the requested input length fits the remaining counter space left by an IV of 13 to 15 bytes. This allows the counter to wrap, causing the keys...

CVE-2026-71884 Packet CTR reports a full success length after the counter is exhausted

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...