org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59649 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512843...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readPacket method of UserAttributeSubpacketInputStream, which reads a 5-octet subpacket length up to Integer.MAXVALUE and allocates new bytebodyLen-1 after checking only against a limit...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.9.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +111 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.1.13)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.97.0-13, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.97.2-02...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...

io.github.epi155:promethium-pgp-jdk5 (0.5-b1), org.igniterealtime.smack:smack-android (>=4.5.0-alpha2, <=4.5.0-beta2) +199 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-jdk15to18 (>=1.71, <=1.84)

org.bouncycastle:bcpg-jdk15to18 MAVEN version =1.71, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-beta3, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.10.0 and more Source cves: CVE-2026-59648 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OnePassSignatures.verify method of OpenPGPMessageInputStream, whose catch PGPSignatureException block for the dataSignature.sanitizekey, policy check contains only a // continue...

org.bouncycastle:bcmail-debug-jdk14 (>=1.81, <=1.84), org.bouncycastle:bcpg-debug-jdk14 (>=1.81, <=1.84) +3 more potentially affected by CVE-2026-59651 via org.bouncycastle:bcprov-debug-jdk14 (>=1.81, <=1.84)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.84 Source cves: CVE-2026-59651 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512578...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OnePassSignatures.verify method of OpenPGPMessageInputStream, whose catch PGPSignatureException block for the dataSignature.sanitizekey, policy check contains only a // continue...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.83), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.83) +4 more potentially affected by CVE-2026-8763 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81, <=1.83)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 Source cves: CVE-2026-8763 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512784...

org.bouncycastle:bcmail-debug-jdk14 (>=1.81, <=1.84), org.bouncycastle:bcpg-debug-jdk14 (>=1.81, <=1.84) +3 more potentially affected by CVE-2026-59650 via org.bouncycastle:bcprov-debug-jdk14 (>=1.81, <=1.84)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.84 Source cves: CVE-2026-59650 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512816...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.83), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.83) +4 more potentially affected by CVE-2026-59650 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81, <=1.83)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 Source cves: CVE-2026-59650 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512815...

org.bouncycastle:bcmail-debug-jdk14 (>=1.81, <=1.84), org.bouncycastle:bcpg-debug-jdk14 (>=1.81, <=1.84) +3 more potentially affected by CVE-2026-8763 via org.bouncycastle:bcprov-debug-jdk14 (>=1.81, <=1.84)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.84 Source cves: CVE-2026-8763 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512785...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-12817 Source advisory...

CVE-2026-12817

CVE-2026-12817 affects Bouncy Castle for Java prior to 1.85, including Java LTS builds before 2.73.12 and BC-FJA before bcpg-fips 1.0.13 (1.0.x), 2.0.13 (2.0.x), and 2.1.13 (2.1.x). The flaw: OpenPGP AEAD decryption skips the final tag on chunk-aligned data, as described in multiple sources. This...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-12817 Source advisory: MEND:CVE-2026-12817...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (2.1.11)

org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59640 Source advisory: MEND:CVE-2026-59640...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (2.1.11)

org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...

com.artipie:debian-adapter (>=v0.30.15, <=v1.17.13), com.artipie:rpm-adapter (>=v0.30.15, <=v1.17.13) +2 more potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-lts8on (>=2.73.2, <=2.73.6)

org.bouncycastle:bcpg-lts8on MAVEN version =2.73.2, =v0.30.15, =v0.30.15, =2.1.9, =2.1.10 Source cves: CVE-2026-59640 Source advisory: MEND:CVE-2026-59640...