EUVD-2026-91988

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-85515

Bouncy Castle for Java versions before 1.86 are vulnerable to a truncation error where truncated OpenPGP encrypted messages are accepted without reporting an error. On the SEIPD version 1 path, this leads to receiving CFB-decrypted plaintext without any integrity checks. On the AEAD path (SEIPD v...

CVE-2026-85515

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-97873

The Bouncy Castle for Java library (before versions 1.86 and LTS 2.73.13 ) contains a vulnerability where the raw JCA provider's legacy PBES1 and PKCS#12 PBE families derive keys using an iteration count from untrusted input without bounding. An attacker could provide a small input to dictate an ...

CVE-2026-97873 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-97873 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

EUVD-2026-91987

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-97873 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-97873

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

PT-2026-104562

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71891: Improper Verification of Cryptographic Signature

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...

CVE-2026-97873: Allocation of Resources Without Limits or Throttling

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

PT-2026-104565

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-71888: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...

PT-2026-104566

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description HQC leaks secret-derived data through two side channels during encapsulation and decapsulation. The GF2^8 arithmetic uses lookup tables indexed by field elements, causing the touched...

CVE-2026-71883: Exposure of Sensitive Information to an Unauthorized Actor

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array...

PT-2026-104559

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java LTS versions prior to 2.73.13 Description One-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM, and GCM-SIV incorrectly use JNI's ReleaseByteArrayElements in mode 0 when releasing the caller's key, IV, and...

PT-2026-104563

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...