EUVD-2026-92006

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...