com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-13506 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-13506 Source advisory: OSV:GHSA-QP49-QGX5-5M26https://v...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-13506 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-13506 Source advisory: GHSA-QP49-QGX5-5M26https://vulne...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58059 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58059 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518056...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +179 more potentially affected by CVE-2026-58059 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-58059 Source advisory:...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58059 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58059 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518056...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58062 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58062 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519206...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58062 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58062 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519206...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +170 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.2)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =2.5.2, =2.5.2, =3.0.0-snap-202609101832 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519142...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.ascentstream.pulsar:pulsar-package-bookkeeper-storage (>=3.0.18.0, <=4.0.11.0) +20 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=2.0.0, <=2.0.1)

org.bouncycastle:bc-fips MAVEN version =2.0.0, =3.0.16.0, =3.0.18.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =3.0.17, =3.22.0, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519142...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +179 more potentially affected by CVE-2026-58061 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-58061 Source advisory:...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.8)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-12802 Source advisor...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-12802 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519225...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.7.1), com.pkixops:pkixops-crypto (1.5.2) +164 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.52.0 and more Source cves: CVE-2026-12802 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519225...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.0), com.adobe.documentservices:pdfservices-sdk (>=2.2.2, <=3.5.1) +179 more potentially affected by CVE-2026-58063 via org.bouncycastle:bc-fips (>=1.0.1, <=1.0.2.6)

org.bouncycastle:bc-fips MAVEN version =1.0.1, =1.26.0, =2.2.2, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.16.8.0, =4.17.4.1 and more Source cves: CVE-2026-58063 Source advisory:...