CVE-2026-71847 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, cinc-auditor, logstash, ruby3.2-rails, ruby3.4-rails, pact-broker-docker-fips, pact-broker-docker, logstash-fips...

GHSA-9HJ4-R449-HFVC vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, cinc-auditor, logstash, ruby3.2-rails, ruby3.4-rails, pact-broker-docker-fips, pact-broker-docker, logstash-fips...

GHSA-V6W3-QRH8-QCCC vulnerabilities

Vulnerabilities for packages: wazuh-indexer, keycloak-fips, guacamole-client, bouncycastle-fips, opensearch...

GHSA-98J2-6V39-78W8 vulnerabilities

Vulnerabilities for packages: wazuh-indexer, keycloak-fips, guacamole-client, elasticsearch, apache-pulsar-fips, cassandra-fips, bouncycastle-fips, opensearch...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, awx, langfuse, prism, jitsucom-jitsu, langfuse-fips, lerna, semaphore, kubeflow-centraldashboard, librechat, wazuh-dashboard, kibana, wazuh-dashboard-fips, redisinsight, nextcloud-server, opensearch-dashboards...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, awx, langfuse, opensearch-dashboards, prism, jitsucom-jitsu, langfuse-fips, lerna, semaphore, kubeflow-centraldashboard, librechat, wazuh-dashboard, kibana, wazuh-dashboard-fips, gitlab-rails-ce, redisinsight, nextcloud-server,...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to the lack of a limit in the retry mechanism for CPU entropy instructions in the native entropy source. An attacker can cause the application to hang indefinitely by triggering persistent failures in the on-chip entro...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to the lack of a limit in the retry mechanism for CPU entropy instructions in the native entropy source. An attacker can cause the application to hang indefinitely by triggering persistent failures in the on-chip entro...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to reliance on the finalize process for zeroizing sensitive key material. An attacker can potentially access sensitive cryptographic keys by exploiting delays in garbage collectio...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to reliance on the finalize process for zeroizing sensitive key material. An attacker can potentially access sensitive cryptographic keys by exploiting delays in garbage collectio...

Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...

Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

GHSA-98J2-6V39-78W8 Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

GHSA-V6W3-QRH8-QCCC Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-8798

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...

CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...