CLEANSTART-2026-XM21821 In Bouncy Castle for Java before 1

CVE-2026-58061 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

TencentOS Server 4: bouncycastle (TSSA-2026:0825)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0825 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:21538-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21538-1 advisory. Update to 1.85. Security issues fixed: - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. -...

CVE-2026-58061 vulnerabilities

Vulnerabilities for packages: bouncycastle-fips...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +30641 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk15on (>=1.46, <=1.70)

org.bouncycastle:bcprov-jdk15on MAVEN version =1.46, =1.0.1, =0.2.3, =4.4.0.0, =0.42.1, =0.1.12, =0.1.2, =0.28.0, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519133...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.h2o:h2o-app (>=0.1.22, <=0.1.25) +1043 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk15 (>=1.38, <=1.46)

org.bouncycastle:bcprov-jdk15 MAVEN version =1.38, =1.3, =0.1.22, =0.1.22, =1.0.0, =2.1.0, =1.0.1, =4.2.0, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.0.3, =1.3.3 and more Source cves: CVE-2026-58061 Source advisory:...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519137...

com.walterjwhite.java.examples:ssh (0.0.17), com.walterjwhite.java.modules.linux-builder.modules.cli.providers:cdi (0.0.17) +24 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-ext-jdk14 (>=1.45, <=1.72)

org.bouncycastle:bcprov-ext-jdk14 MAVEN version =1.45, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519138...

br.com.swconsultoria:java-cte (>=3.00.4, <=3.00.8), br.com.swconsultoria:java-mdfe (>=3.00.3, <=3.00.4) +1215 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk16 (>=1.38, <=1.46)

org.bouncycastle:bcprov-jdk16 MAVEN version =1.38, =3.00.4, =3.00.3, =4.00.10, =1.0, =2.0, =1.2.4, =2.0.0, =2.1-alpha1, =2.1-alpha1, =2.10.0, =2.10.0, =2.11.0 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519135...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1898 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk15to18 (>=1.63, <=1.84)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.63, =0.0.2, =0.0.1, =0.2.9, =0.1.0, =0.2.1, =0.2.0, =0.1.0-m36, =0.1.0-m26, =1.0.0, =1.0.1-rc14, =0.2.0, =0.2.0, =0.3.0 - ch.pontius.nio:smb-nio 0.9.0 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519128...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1, <=1.2.2), ca.denisab85:tn5250j (1.0.0) +127 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk14 (>=1.38, <=1.84)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.p24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.restassuredpdfreport:com.github.lkkushan101.restassuredpdfreport 1.00 and more Source cves: CVE-2026-58061 Source advisory:...

com.amazonaws.s3:jets3t (0.5.0), org.bouncycastle:bcpg-jdk12 (130) +2 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk12 (130)

org.bouncycastle:bcprov-jdk12 MAVEN version 130 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-jdk12 and may be impacted: - com.amazonaws.s3:jets3t 0.5.0 - org.bouncycastle:bcpg-jdk12 130 - org.vafer:jdeb =0.2, =0.2.1, =0.5.0...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +166 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-58061 Source advisory:...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1898 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk15to18 (>=1.63, <=1.84)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.63, =0.0.2, =0.0.1, =0.2.9, =0.1.0, =0.2.1, =0.2.0, =0.1.0-m36, =0.1.0-m26, =1.0.0, =1.0.1-rc14, =0.2.0, =0.2.0, =0.3.0 - ch.pontius.nio:smb-nio 0.9.0 and more Source cves: CVE-2026-58061 Source advisory: MEND:CVE-2026-58061...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58061 Source advisory: MEND:CVE-2026-58061...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58061 Source advisory: MEND:CVE-2026-58061https://vulne...

CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

Linux Distros Unpatched Vulnerability : CVE-2026-58061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS...

SUSE CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...