Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (2.1.11)

org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the readBlock method of PGPAeadInputStream BcAEADUtil, mirrored in JceAEADUtil, which pre-reads the final 16 bytes but ignores the result and returns EOF without calling doFinal when the...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +179 more potentially affected by CVE-2026-14682 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-14682 Source advisory:...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +179 more potentially affected by CVE-2026-13506 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-13506 Source advisory:...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth counter is reset rather than inherited from the parent parse, and never calls...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-14682 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-14682 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518102...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-14682 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-14682 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518102...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-13506 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-13506 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519025...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-13506 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-13506 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519025...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth counter is reset rather than inherited from the parent parse, and never calls...

CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...

CVE-2026-13586

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-13506

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-12817

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

UBUNTU-CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...