CVE-2026-12860

🗓️ 03 Aug 2026 04:16:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 11 Views

RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path in Bouncy Castle Java <1.85.

Reporter	Title	Published	Views	Family All 64
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i	15 Sep 202613:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026	31 Aug 202610:29	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	16 Sep 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	27 Aug 202619:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Bouncy Castle	16 Sep 202607:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle vulnerabilities that could cause denial of service, resource exhaustion, cryptographic verification bypass, or other security impacts.	3 Sep 202613:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java	9 Sep 202604:41	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java	8 Sep 202614:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle	15 Sep 202604:25	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:57	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	18.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	20.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	22.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	24.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	26.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	16.04	all	bouncycastle	0	bouncycastle_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012860
github	www.github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396

31 Aug 2026 06:44Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.3

CVSS 48.7

EPSS0.00143

SSVC

Bouncy Castle RSA PKCS#1 hash verification NULL-omitted path verification bypass