Nesting-Depth Guard Bypass

🗓️ 27 Aug 2026 04:36:53Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 4 Views

Nesting-depth guard bypass in Bouncy Castle for Java allows exploitation of nested ASN.1 structures.

Reporter	Title	Published	Views	Family All 517
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i	15 Sep 202613:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF002 for August 2026	17 Sep 202614:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026	31 Aug 202610:29	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	16 Sep 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	27 Aug 202619:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Bouncy Castle	16 Sep 202607:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in bcprov-jdk18on bundled with IBM Fusion and IBM Fusion HCI.	1 Oct 202623:41	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities in Bouncy Castle for Java	29 Sep 202617:05	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Memory Allocation, Improper Validation, Inadequate Encryption Strength, Inefficient Algorithmic Complexity and LDAP Injection.	22 Sep 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition	22 Sep 202607:04	–	ibm

Vulners

Node

bc-fips-debug bc-fips-debugRange1.0.2–2.0.1java

bouncycastle bc-fipsRange2.1.0–2.1.2java

bouncycastle bc-fipsRange2.0.0–2.0.1java

bouncycastle bc-fipsRange1.0.0–1.0.2.6java

bcprov-debug-lts8on bcprov-debug-lts8onRange2.73.0–2.73.11java

bcprov-lts8on bcprov-lts8onRange2.73.0–2.73.11java

bcprov-ext-debug-jdk14 bcprov-ext-debug-jdk14Range1.59–1.74java

bcprov-ext-jdk14 bcprov-ext-jdk14Range1.45–1.78.1java

bcprov-debug-jdk15on bcprov-debug-jdk15onRange1.45–1.78.1java

bcprov-debug-jdk14 bcprov-debug-jdk14Range1.49–1.84java

bcprov-debug-jdk15to18 bcprov-debug-jdk15to18Range1.49–1.84java

bcprov-debug-jdk18on bcprov-debug-jdk18onRange1.59–1.84java

bcprov-jdk12 bcprov-jdk12Range1.61–130java

bcprov-jdk16 bcprov-jdk16Range1.38–1.73java

bcprov-jdk15 bcprov-jdk15Range1.32–138java

bcprov-jdk15on bcprov-jdk15onRange1.0.3–1.78java

bcprov-jdk14 bcprov-jdk14Range1.0–1.84java

bcprov-jdk15to18 bcprov-jdk15to18Range1.0–1.84java

bcprov-jdk18on bcprov-jdk18onRange1.0–1.84java

Source	Link
github	www.github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84
github	www.github.com/bcgit/bc-java/wiki/CVE-2026-13506
github	www.github.com/advisories/GHSA-qp49-qgx5-5m26

19 Sep 2026 05:24Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

CVSS 48.7

EPSS0.00442

SSVC