Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle

Summary Bouncy Castle for Java before 1.85 was affected with the following CVE's.CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055, CVE-2026-58059, CVE-2026-58060, CVE-2026-58061, CVE-2026-58062, CVE-2026-58063,...

Security Bulletin: IBM ApplinX is vulnerable to issues like Memory allocation, verification and validation issues due to the use of Bouncy Castle for Java (CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860 are some of the example CVEs).

Summary IBM ApplinX is vulnerable to issues like Memory allocation, verification and validation issues due to the use of Bouncy Castle for Java CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860 are some of the example CVEs. The affected versions have been updated within IBM ApplinX i...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.1...

CVE-2026-59643

A flaw was found in Bouncy Castle for Java and Bouncy Castle for Java FIPS BC-FJA. This vulnerability allows an attacker to bypass OpenPGP inline-signature policy failures, which are silently ignored by the software. This silent disregard of policy failures can lead to a compromise of data...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referentia...

DoS (Denial of Service) Apache Tomcat Dependency in Jira Service Management Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-13506 was introduced in 10.0.0 and later of Jira Service Management Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

DoS (Denial of Service) Bouncy Castle Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability known as CVE-2026-58059 was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

CVE-2026-13586

A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting an iteration-count bound issue in the PKCS12 Message Authentication Code MAC and bag-decryption Key Derivation Function KDF. This could make the affected system...

CVE-2026-59646

A flaw was found in Bouncy Castle for Java. The DTLS Datagram Transport Layer Security handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive...

CVE-2026-59647

A flaw was found in Bouncy Castle for Java. The Certificate Request Message Format CRMF and Certificate Management Protocol CMP password-based Message Authentication Code MAC implementation allows for an unbounded iteration count. A remote attacker can exploit this by sending a specially crafted...

DoS (Denial of Service) Apache Tomcat Dependency in Crowd Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-13506 was introduced in 6.1.0 and later of Crowd Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505

CVE-2026-13505 concerns Bouncy Castle for Java FIPS (BC-FJA). The issue: sensitive key material held by AES/DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and PBKD/scrypt parameter classes was zeroised on garbage collection via Object.finalize. Finalization is non-deterministic and runs on...

EUVD-2026-54726

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...

CVE-2026-13586

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-12816

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12860

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12817

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...