com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.14.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-71889 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536909...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71892 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536917...

Incorrect Comparison

Overview Affected versions of this package are vulnerable to Incorrect Comparison through the JceKeyTransRecipient key transport path in pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyTransRecipient.java. An attacker can bypass the opt-in key-size check and have an EnvelopedData or...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.14.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-71892 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536917...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-85515 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-85515 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536961...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +111 more potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.1.11, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.1.11, =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.97.0-13, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.97.2-02...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

DEBIAN-CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

UBUNTU-CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71888 Source advisory: MEND:CVE-2026-71888...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-71888 Source advisor...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.14.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-71888 Source advisory: MEND:CVE-2026-71888...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

com.ascentstream.pulsar:bcfips-include-test (>=3.0.7.0-snapshot-a030c50, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.7.0-snapshot-a030c50, <=3.0.14.1) +11 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=1.0.5, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.5, =3.0.7.0-snapshot-a030c50, =3.0.7.0-snapshot-a030c50, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =3.1.0, =master-rc-daily, =master-rc-daily, =3.13.14, =3.0.0, =19.0.0, =25.0.6 Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.14.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71892 Source advisory: MEND:CVE-2026-71892...

CVE-2026-71892

Bouncy Castle for Java versions before 1.86 contain a flaw where opt-in key-size validation on CMS key-transport recipients fails for messages using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256 ). The root cause is an incorrect comparison between a byte array and an ASN1Obje...

CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...