Bouncycastle Fips Java Api vulnerabilities

• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) CVE-2026-13586 Fix available 5.3 MediumAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Lazy ASN.1 sequence forcing resets nesting-depth guard CVE-2026-13506 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bctls-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +3 more +5 more Possible OOM from unbounded up-front allocation on a definite-length read CVE-2026-14682 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Quadratic-time escaping when stringifying X.500 distinguished names CVE-2026-58059 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more HSS public-key level count unbounded, enabling huge allocation on verify CVE-2026-58060 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more CCM-family modes write plaintext to caller buffer before tag check CVE-2026-58061 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Stapled OCSP response accepted without binding to the checked certificate CVE-2026-58062 Public exploitFix available 9.3 CriticalAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more BCFKS keystore load honours unbounded KDF cost from untrusted file CVE-2026-58063 Fix available 5.3 MediumAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-8763 Fix available 9.3 CriticalAugust 3, 2026
• bouncycastle bouncy castle for java, fips java api +1 more Bouncy Castle Denial of Service (DoS) CVE-2023-33202 Fix available 5.5 MediumNovember 23, 2023
• bouncycastle fips java api Garbage collection issue in BC-FJA in Java 13 and later CVE-2022-45146 Fix available 5.5 MediumNovember 21, 2022
• bouncycastle bc-csharp, bouncy castle fips .net api, fips java api +1 more +3 more Timing based private key exposure in Bouncy Castle CVE-2020-15522 Fix available 5.9 MediumMay 20, 2021
• bouncycastle fips java api, legion-of-the-bouncy-castle +1 more Observable Differences in Behavior to Error Inputs in Bouncy Castle CVE-2020-26939 Fix available 5.3 MediumNovember 2, 2020
• bouncycastle bc-java, fips java api, debian linux +17 more +19 more Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator CVE-2018-1000180 Fix available 7.5 HighJune 5, 2018