com.ascentstream.pulsar:bcfips-include-test (>=3.0.7.0-snapshot-a030c50, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.7.0-snapshot-a030c50, <=3.0.14.1) +11 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=1.0.5, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.5, =3.0.7.0-snapshot-a030c50, =3.0.7.0-snapshot-a030c50, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =3.1.0, =master-rc-daily, =master-rc-daily, =3.13.14, =3.0.0, =19.0.0, =25.0.6 Source cves: CVE-2026-71889 Source advisory:...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-71888 Source advisor...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536979...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71892 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536917...

Incorrect Comparison

Overview Affected versions of this package are vulnerable to Incorrect Comparison through the JceKeyTransRecipient key transport path in pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyTransRecipient.java. An attacker can bypass the opt-in key-size check and have an EnvelopedData or...

com.ascentstream.pulsar:bcfips-include-test (>=3.0.7.0-snapshot-a030c50, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.7.0-snapshot-a030c50, <=3.0.14.1) +11 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=1.0.5, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.5, =3.0.7.0-snapshot-a030c50, =3.0.7.0-snapshot-a030c50, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =3.1.0, =master-rc-daily, =master-rc-daily, =3.13.14, =3.0.0, =19.0.0, =25.0.6 Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-17508 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20535447...

Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2025-8916)

Summary There are vulnerabilities in bcpkix-fips-1.0.7.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-8916. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-8916 DESCRIPTION: Allocation of Resources Without Limits or Throttling vulnerability in...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-12802 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519225...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.8)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-12802 Source advisor...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.7.1), com.pkixops:pkixops-crypto (1.5.2) +164 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.52.0 and more Source cves: CVE-2026-15055 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18517503...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.8)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-15055 Source advisor...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the CMSSignedData.verifySignaturesSignerInformationVerifierProvider, boolean method, which iterates the signer set and returns true on loop completion without checking that any signer ...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.7.1), com.pkixops:pkixops-crypto (1.5.2) +164 more potentially affected by CVE-2026-59639 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.52.0 and more Source cves: CVE-2026-59639 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18513029...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-59639 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.8)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-59639 Source advisor...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-59647 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-59647 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18513020...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-59642 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-59642 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512975...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-12802 Source advisory: MEND:CVE-2026-12802...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-59639 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.8)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-59639 Source advisor...