Skip to contentBouncycastle Bcpkix-fips vulnerabilities
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreCMS AuthEnvelopedData fails to enforce tag-length on decryptionCVE-2026-12802Fix available8.7 High
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreCMS verifySignatures returns true for SignedData with zero signersCVE-2026-59639Fix available8.7 High
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreCMS AuthenticatedData content not bound to MAC when authAttrs presentCVE-2026-59642Fix available8.7 High
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreCRMF/CMP password-MAC honours unbounded iteration countCVE-2026-59647Fix available6.9 Medium
- bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 morePKCS#8 / PBES2 decryptors honour unbounded KDF cost from inputCVE-2026-15055Fix available5.3 Medium