CVE-2026-58060

🗓️ 03 Aug 2026 03:16:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 9 Views

HSS public-key level count unbounded in Bouncy Castle Java before 1.85 enabling huge allocation on verify.

Reporter	Title	Published	Views	Family All 62
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i	15 Sep 202613:43	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in Bouncy Castle for Java	8 Sep 202614:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle	15 Sep 202604:25	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service	24 Aug 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to issues like Memory allocation, verification and validation issues due to the use of Bouncy Castle for Java (CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860 are some of the example CVEs).	12 Sep 202615:02	–	ibm
ATTACKERKB	CVE-2026-58060	3 Aug 202602:37	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2026-2153)	14 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:21538-1)	8 Aug 202600:00	–	nessus
Tenable Nessus	SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:3559-1)	12 Aug 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	18.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	20.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	22.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	24.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	26.04	all	bouncycastle	0	bouncycastle_0_all.deb
Ubuntu	16.04	all	bouncycastle	0	bouncycastle_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058060
github	www.github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276
github	www.github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922

04 Sep 2026 02:47Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.17.5

CVSS 48.7

EPSS0.00651

SSVC

Bouncy Castle Java HSS unbounded allocation denial of service public-key verification