EUVD-2026-52032

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X seri...

CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

EUVD-2026-52031

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-59643 OpenPGP inline-signature policy failures silently ignored

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-59643

CVE-2026-59643 affects Bouncy Castle for Java prior to 1.85 and BC-FJA prior to bcpg-fips 2.0.13, where OpenPGP inline-signature policy failures are silently ignored. This implies that inline-signature policy checks may not be enforced, potentially allowing signatures to bypass policy constraints...

CVE-2026-59643 OpenPGP inline-signature policy failures silently ignored

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-59643 OpenPGP inline-signature policy failures silently ignored

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

EUVD-2026-52030

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

CVE-2026-59644

CVE-2026-59644 affects Bouncy Castle for Java up to version 1.84, where the MLS hash-ratchet may honor an arbitrary 32-bit generation counter from the sender. This can impact availability (per CVSS: HIGH) with no confidentiality or integrity impact reported, and no exploitation details are provid...

EUVD-2026-52029

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

CVE-2026-59645

CVE-2026-59645 affects Bouncy Castle for Java where the OER parser recurses without a depth limit on a self-referential IEEE 1609.2 schema. Affected products/versions include Java edition before 1.85, Java LTS before 2.73.12, and BC-FJA (Java FIPS) before bcutil-fips 2.0.7 (2.0.x series) and 2.1....

CVE-2026-59645

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

CVE-2026-59645

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...