DEBIAN-CVE-2026-59645

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

CVE-2026-59645

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

CVE-2026-59645

CVE-2026-59645 affects Bouncy Castle for Java where the OER parser recurses without a depth limit on a self-referential IEEE 1609.2 schema. Affected products/versions include Java edition before 1.85, Java LTS before 2.73.12, and BC-FJA (Java FIPS) before bcutil-fips 2.0.7 (2.0.x series) and 2.1....

CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

PT-2026-67238

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcutil-fips versions prior to 2.0.7 Bouncy Castle for Java FIPS BC-FJA bcutil-fips versions prior to 2.1.7...

GHSA-RV48-QQJ5-CRXG Protobuf: Unbounded recursion depth in embedded-message decoding

Summary Unbounded recursion depth in Protobuf.Decoder Hex package protobuf, versions = 0.8.0, 0.16.1 lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body a few KB to a few ...