co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.56.0), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +112 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=1.0.4, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.96.0-09 and more Source cves: CVE-2026-59648https://vulners.c...

CVE-2026-59648 OpenPGP Argon2 S2K honours attacker-chosen memory and passes

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

SUSE CVE-2026-59648

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...