CLEANSTART-2026-FC85251 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-LZ89821 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-HT00159 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-NX17544 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-EJ43845 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-RK76789 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-WQ77811 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-DU85767 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-JR63274 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-LA60535 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-RY43720 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-NR86406 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-XU20448 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CVE-2026-71888

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...

CVE-2026-71889

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

CVE-2026-97873

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-17507

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...