CLSA-2026-1793133867 TuxCare security update for org.bouncycastle (1 CVE)

TuxCare rebuilt 10 org.bouncycastle packages to address 1 CVE. Fixed in 1.75-tuxcare.2...

CLSA-2026-1792700416 TuxCare security update for org.bouncycastle (1 CVE)

TuxCare rebuilt 3 org.bouncycastle packages to address 1 CVE. Fixed in 1.77-tuxcare.4...

CLSA-2026-1792696243 TuxCare security update for org.bouncycastle (9 CVEs)

TuxCare rebuilt 39 org.bouncycastle packages to address 9 CVEs. Fixed in 1.75-tuxcare.1...

CLSA-2026-1792694254 TuxCare security update for org.bouncycastle (3 CVEs)

TuxCare rebuilt 16 org.bouncycastle packages to address 3 CVEs. Fixed in 1.76-tuxcare.5...

CLSA-2026-1792693862 TuxCare security update for org.bouncycastle (1 CVE)

TuxCare rebuilt 9 org.bouncycastle packages to address 1 CVE. Fixed in 1.81.1-tuxcare.1...

CLSA-2026-1791311173 TuxCare security update for org.bouncycastle (3 CVEs)

TuxCare rebuilt 39 org.bouncycastle packages to address 3 CVEs. Fixed in 1.78.1-tuxcare.8...

CLSA-2026-1791306023 TuxCare security update for org.bouncycastle (7 CVEs)

TuxCare rebuilt 32 org.bouncycastle packages to address 7 CVEs. Fixed in 1.77-tuxcare.3...

PT-2026-116181

TuxCare rebuilt 39 org.bouncycastle packages to address 3 CVEs. Fixed in 1.78.1-tuxcare.8...

PT-2026-115974

TuxCare rebuilt 38 org.bouncycastle packages to address 7 CVEs. Fixed in 1.77-tuxcare.3...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in LeafNode.verify in org.bouncycastle.mls.codec, which never checks that the subject public key of the X.509 credential's end entity certificate matches the leaf's signaturekey field, although RFC 9420...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in LeafNode.verify in org.bouncycastle.mls.codec, which never checks that the subject public key of the X.509 credential's end entity certificate matches the leaf's signaturekey field, although RFC 9420...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-debug-jdk18on (>=1.74, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.74, =4.7.0, =4.7.0, =3.0.0-rc1, =3.0.0-rc1, =3.2.0, =3.20.7, =3.20.7, =3.20.7, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-18040 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536926...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1, <=1.2.2), ca.denisab85:tn5250j (1.0.0) +127 more potentially affected by CVE-2026-97873 via org.bouncycastle:bcprov-jdk14 (>=1.38, <=1.85.1)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.p24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.restassuredpdfreport:com.github.lkkushan101.restassuredpdfreport 1.00 and more Source cves: CVE-2026-97873 Source advisory:...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1338 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-jdk15to18 (>=1.72, <=1.85.1)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.72, =0.0.2, =0.0.2.1, =0.2.9, =0.2.8, =0.2.8, =0.2.8, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 and more Source cves: CVE-2026-18040 Source advisory: MEND:CVE-2026-18040...

ROOT-APP-MAVEN-AIKIDO-2026-572912 AIKIDO-2026-572912 in org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched AIKIDO-2026-572912 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...