DEBIAN-CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

UBUNTU-CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java versions before 1.86 , the Messaging Layer Security (MLS, RFC 9420) implementation failed to bind an X.509 credential to a LeafNode's signature_key . Because the X.509 certificate chain was stored but never parsed or validated, the end-entity certificate's public key was...

CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

EUVD-2026-92003

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

CVE-2026-71885: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...

Linux Distros Unpatched Vulnerability : CVE-2026-71885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey...

CVE-2026-17507

A flaw was found in Bouncy Castle's Messaging Layer Security MLS implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbound...

CVE-2026-12852 MLS wire decoder allocates attacker-declared opaque length before bounds check

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check...

CVE-2026-12852 MLS wire decoder allocates attacker-declared opaque length before bounds check

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check...

A malicious user can spam ghost deposits to DoS the LayerZeroEndpoint messaging layer

Lines of code Vulnerability details Impact There can be many deposits that will strain the messaging layer, especially in chains that do not cost much to send a transaction. Proof of Concept The entry point of the bridge is callOutSignedAndBridge in BranchBridgeAgent.sol. This function will pack...

openSUSE 10 Security Update : heartbeat (heartbeat-2139)

This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. CVE-2006-3815,CVE-2006-3121 %NASLMINLEVEL 70300 C Tenable Network...