CVE-2026-13505

A flaw was found in Bouncy Castle for Java FIPS BC-FJA. Sensitive cryptographic key material, intended to be securely erased from memory zeroised upon garbage collection, may persist longer than expected. This occurs because the zeroisation process relies on a deprecated Java finalization...