app.cash.backfila:client-misk-hibernate (>=2025.05.13.195510-03b951f, <=2026.10.01.201111-ad9f619), app.cash.backfila:service (>=2025.05.13.195510-03b951f, <=2026.10.01.201111-ad9f619) +1204 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpg-jdk18on MAVEN version =1.71, =2025.05.13.195510-03b951f, =2025.05.13.195510-03b951f, =2025.05.13.195510-03b951f, =1.0.0, =1.0.0, =1.1, =4.3.0.549.vf2adaad19b5e, =1.5.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-59648 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512852...

CVE-2026-59648 OpenPGP Argon2 S2K honours attacker-chosen memory and passes

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59648 Source advisory: MEND:CVE-2026-59648...

cn.loyom.boot:loyom-boot-business-demo (1.0.3-jdk21), cn.loyom.boot:loyom-boot-business-sqlite-exe-demo (1.0.3-jdk21) +432 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcprov-lts8on (>=2.73.0, <=2.73.11)

org.bouncycastle:bcprov-lts8on MAVEN version =2.73.0, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.3-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.3-jdk21, =1.0.3.2-jdk21 and more Source cves: CVE-2026-59648 Source advisory:...

com.artipie:debian-adapter (>=v0.30.15, <=v1.17.13), com.artipie:rpm-adapter (>=v0.30.15, <=v1.17.13) +2 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-lts8on (>=2.73.2, <=2.73.6)

org.bouncycastle:bcpg-lts8on MAVEN version =2.73.2, =v0.30.15, =v0.30.15, =2.1.9, =2.1.10 Source cves: CVE-2026-59648 Source advisory: MEND:CVE-2026-59648...

SUSE CVE-2026-59648

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...