Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readPacket method of UserAttributeSubpacketInputStream, which reads a 5-octet subpacket length up to Integer.MAXVALUE and allocates new bytebodyLen-1 after checking only against a limit...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readPacket method of UserAttributeSubpacketInputStream, which reads a 5-octet subpacket length up to Integer.MAXVALUE and allocates new bytebodyLen-1 after checking only against a limit...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readPacket method of UserAttributeSubpacketInputStream, which reads a 5-octet subpacket length up to Integer.MAXVALUE and allocates new bytebodyLen-1 after checking only against a limit...

DEBIAN-CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

UBUNTU-CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59649

The CVE affects Bouncy Castle for Java: OpenPGP user-attribute subpacket length is currently bounded only by JVM max memory. Affected versions are before 1.85 (and LTS before 2.73.12) and BC-FJA before bcpg-fips 1.0.13 (1.0.x series), 2.0.13 (2.0.x), and 2.1.13 (2.1.x). Practical impact, as state...

EUVD-2026-52025

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59649 OpenPGP user-attribute subpacket length bounded only by JVM max memory

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59649 OpenPGP user-attribute subpacket length bounded only by JVM max memory

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

PT-2026-67242

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcpg-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS BC-FJA bcpg-fips versions prior to 2.0.13 Boun...