CVE-2026-12802

🗓️ 03 Aug 2026 04:16:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 8 Views

CMS AuthEnvelopedData in Bouncy Castle Java before 1.85 fails to enforce tag-length on decryption.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle vulnerabilities that could cause denial of service, resource exhaustion, cryptographic verification bypass, or other security impacts.	3 Sep 202613:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i	15 Sep 202613:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring, Tomcat, Netty, PostCSS might affect IBM Storage Protect Plus	9 Sep 202613:18	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	14 Sep 202605:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle 1.84	16 Sep 202612:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	27 Aug 202606:11	–	ibm
ATTACKERKB	CVE-2026-12802	3 Aug 202602:48	–	attackerkb
Atlassian	Cryptographic Failure org.bouncycastle:bcpkix-jdk18on Dependency in Bamboo Data Center	7 Aug 202616:30	–	atlassian
Atlassian	Broken Authentication & Session Management org.bouncycastle:bcpkix-lts8on Dependency in Confluence Data Center	7 Aug 202616:30	–	atlassian

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	18.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	20.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	22.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	24.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	26.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	16.04	all	bouncycastle	0	bouncycastle_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012802
github	www.github.com/bcgit/bc-java/commit/0fefa539e6ac5c66e1daee5a13b23d1d4769cc01

03 Sep 2026 23:03Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.17.5

CVSS 48.7

EPSS0.00147

SSVC

Bouncy Castle Java AuthEnvelopedData tag-length enforcement CMS decryption cryptographic validation