123 matches found
DEBIAN-CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
UBUNTU-CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71890 MLS external commit can remove an arbitrary group member
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71890 MLS external commit can remove an arbitrary group member
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71890 MLS external commit can remove an arbitrary group member
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key
In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...
CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key
In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signaturekey. LeafNode.verify checked a leaf's signature against the signaturekey carried in the leaf itself, while the credential's X.509 certificate...
Linux Distros Unpatched Vulnerability : CVE-2026-71890
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list,...
Linux Distros Unpatched Vulnerability : CVE-2026-17507
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the t...
PT-2026-104567
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description The Messaging Layer Security MLS, RFC 9420 implementation fails to bind an X.509 credential to a LeafNode signature key. The LeafNode.verify function validates a leaf signature against...
CVE-2026-71890: Incorrect Authorization
In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...
PT-2026-104569
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description Validation of an MLS RFC 9420 external commit's proposal list in the validateExternalCachedProposals function of org.bouncycastle.mls.protocol.Group failed to verify that a removed leaf...
CVE-2026-17507
A flaw was found in Bouncy Castle's Messaging Layer Security MLS implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbound...
DEBIAN-CVE-2026-17507
In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...
CVE-2026-17507
In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...
UBUNTU-CVE-2026-17507
In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...