CVE-2026-59645

CVE-2026-59645 affects Bouncy Castle for Java where the OER parser recurses without a depth limit on a self-referential IEEE 1609.2 schema. Affected products/versions include Java edition before 1.85, Java LTS before 2.73.12, and BC-FJA (Java FIPS) before bcutil-fips 2.0.7 (2.0.x series) and 2.1....