CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58059 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58059 Source advisory: MEND:CVE-2026-58059...

CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58060 HSS public-key level count unbounded, enabling huge allocation on verify

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58060 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58060 Source advisory: MEND:CVE-2026-58060...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58060 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58060 Source advisory: MEND:CVE-2026-58060https://vulne...

CVE-2026-58060

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58061

CVE-2026-58061 affects Bouncy Castle for Java: CCM-family modes may write plaintext to the caller buffer before tag verification. Affected are BC Java before 1.85, Java LTS before 2.73.12, and BC-FJA before bc-fips 1.0.2.7 (1.0.x), 2.0.2 (2.0.x), and 2.1.3 (2.1.x). Exploitation is network-based; ...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58061 Source advisory: MEND:CVE-2026-58061...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58061 Source advisory: MEND:CVE-2026-58061https://vulne...

EUVD-2026-52090

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +179 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-58061 Source advisory:...

CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58062 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58062 Source advisory: MEND:CVE-2026-58062...

CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58062 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58062 Source advisory: MEND:CVE-2026-58062https://vulne...

EUVD-2026-52089

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...