Skip to contentBouncycastle Bcpg-fips vulnerabilities
- bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreOpenPGP AEAD decryption skips final tag on chunk-aligned dataCVE-2026-12817Fix available8.7 High
- bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreOpenPGP CFB quick-check oracle active on symmetric/session-key pathsCVE-2026-59640Fix available8.7 High
- bouncycastle bcpg-fips, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 moreOpenPGP inline-signature policy failures silently ignoredCVE-2026-59643Fix available8.7 High
- bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreOpenPGP Argon2 S2K honours attacker-chosen memory and passesCVE-2026-59648Fix available6.9 Medium
- bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreOpenPGP user-attribute subpacket length bounded only by JVM max memoryCVE-2026-59649Fix available8.7 High