CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

EUVD-2026-92003

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java versions before 1.86 , the Messaging Layer Security (MLS, RFC 9420) implementation failed to bind an X.509 credential to a LeafNode's signature_key . Because the X.509 certificate chain was stored but never parsed or validated, the end-entity certificate's public key was...

CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-17507

A flaw was found in Bouncy Castle's Messaging Layer Security MLS implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbound...

Security Bulletin: IBM i is Affected by Algorithm Downgrade in Transport Layer Security [CVE-2026-4942]

Summary IBM i Transport Layer Security TLS is vulnerable to selection of less-secure algorithm during negotation CVE-2026-4942 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-4942 DESCRIPTION: IBM i could allow a remote attacker to send a specifically craft...

Security Bulletin: IBM Storage Protect Server is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS due to IBM SDK, Java (CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754)

Summary IBM SDK, Java is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS, IBM Storage Protect Server uses IBM SDK, Java and may be affected by this vulnerability. Vulnerability Details CVEID:CVE-2025-50106 DESCRIPTION: Vulnerability in the Oracle Java SE,...

CVE-2026-87195

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Hyperion Financial...

Astra Linux – Vulnerability in exim4

In versions of Exim prior to 4.99.3, and under certain GnuTLS configurations, there is a remotely reachable use-after-free in the BDAT body parsing path. This issue is triggered when a client sends a TLS closenotify message during a CHUNKING transfer, followed by a final cleartext byte on the sam...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – Vulnerability in curl

When curl version 7.20.0 or later connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can send multiple responses at once, which are cached by curl. In this case, curl upgrades to TLS, but it does not discard the cached responses. Instead, it...

Astra Linux – Vulnerability in Erlang

In Erlang/OTP versions prior to 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there was a situation where Client Authentication Bypass occurred in certain client-certification scenarios for SSL, TLS, and DTLS...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net/tls: The bug related to slab-out-of-bounds condition in decryptinternal has been fixed. The memory size of tlsctx-rx.iv for AES128-CCM is 12 bytes when tlssetswoffload is called. The return value of cryptoaeadivsize for...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: tls: handling of backlogging of crypto requests Since we are setting the CRYPTOTFMREQMAYBACKLOG flag on our requests to the crypto API, cryptoaeadencrypt,decrypt can return -EBUSY instead of -EINPROGRESS in valid situations...

Astra Linux – Vulnerability in Python 3.7, Python 2.7, Pypy

A vulnerability was discovered in Python before version 3.8.18, 3.9.x before version 3.9.18, 3.10.x before version 3.10.13, and 3.11.x before version 3.11.5. This vulnerability primarily affects servers such as HTTP servers that use TLS client authentication. When a TLS server-side socket is...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. The vulnerability is difficult to exploit; an unauthenticated...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. In versions starting from 2.6 and prior to 7.4.3, an unauthenticated client can cause the output buffer to grow indefinitely, until the server runs out of memory or is terminated. By default, Redis’s configuration does not...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between the async notify and socket close operations. The thread that submitted the request the one that called recvmsg/sendmsg may exit as soon as the async crypto handler’s complete function is...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between TX work scheduling and socket closure. Similar to previous commits, the submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler’s call completes. Reordering the...