bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in OpenPGPCertificate.getCertificationBy and getDelegationBy in the OpenPGP certificate API. An attacker can have a third-party certification or direct-key trust delegation accepted as if it were issued by the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in OpenPGPCertificate.getCertificationBy and getDelegationBy in the OpenPGP certificate API. An attacker can have a third-party certification or direct-key trust delegation accepted as if it were issued by the...

org.bouncycastle:bcmail-debug-jdk14 (>=1.81, <=1.85), org.bouncycastle:bcpg-debug-jdk14 (>=1.81, <=1.85) +3 more potentially affected by CVE-2026-97873 via org.bouncycastle:bcprov-debug-jdk14 (>=1.81, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85.1 Source cves: CVE-2026-97873 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536963...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-97873 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-97873 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536965...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-85515 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536961...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-85515 Source advisory...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +111 more potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.1.11, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.1.11, =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.97.0-13, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.97.2-02...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.85) +4 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85.1 Source cves: CVE-2026-18040 Source advisory: MEND:CVE-2026-18040...

io.github.epi155:promethium-pgp-jdk5 (0.5-b1), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.84.0-03, <=3.88.0-08) +109 more potentially affected by CVE-2026-71886 via org.bouncycastle:bcpg-jdk15to18 (>=1.81, <=1.84)

org.bouncycastle:bcpg-jdk15to18 MAVEN version =1.81, =3.84.0-03, =3.84.0-03, =3.84.0-03, =3.84.0-03, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.92.3-01 and more S...

org.bouncycastle:bcmail-debug-jdk14 (>=1.81, <=1.85), org.bouncycastle:bcpg-debug-jdk14 (>=1.81, <=1.85) +3 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcprov-debug-jdk14 (>=1.81, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85.1 Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-85515 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-85515 Source advisory: MEND:CVE-2026-85515...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +111 more potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-fips (>=2.1.11, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.1.11, =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.97.0-13, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.97.2-02...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.85) +4 more potentially affected by CVE-2026-18036 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85.1 Source cves: CVE-2026-18036 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20419432...