Critical severity9.1OSV Advisory· Published Aug 3, 2026· Updated Sep 2, 2026
CVE-2026-58062
CVE-2026-58062
Description
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- Range: r2rv73dot11, r2rv73dot10, r2rv73dot9, …
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*range: >=1.66,<1.85
- (no CPE)range: <1.85, <2.73.12, <2.0.2, <2.1.3
- cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*Range: <=2.73.11
- cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*Range: <2.0.2
- Range: <2.0.2, <2.1.3
- osv-coords3 versionspkg:apk/chainguard/bouncycastle-fipspkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Tumbleweed
< 2.1.3-r0+ 2 more
- (no CPE)range: < 2.1.3-r0
- (no CPE)range: < 1.85-160000.1.1
- (no CPE)range: < 1.85-1.1
Patches
Vulnerability mechanics
References
1News mentions
5- ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and MoreThe Hacker News · Oct 26, 2026
- Atlassian Patches 75 Flaws in Data Center and Server ProductsSecurityWeek · Oct 23, 2026
- Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and ConfluenceCyber Security News · Oct 22, 2026
- Bouncy Castle for Java: 25 Vulnerabilities Disclosed Together on August 3, 2026Vypr Intelligence · Aug 3, 2026
- Bouncy Castle for Java: 25 Vulnerabilities Disclosed in Single Batch on August 3, 2026Vypr Intelligence · Aug 3, 2026