Critical severity9.1OSV Advisory· Published Aug 3, 2026· Updated Sep 2, 2026

CVE-2026-58062

Description

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Legion Of The Bouncy Castle Inc./Bc Lts JavaOSV
Range: r2rv73dot11, r2rv73dot10, r2rv73dot9, …
osv-coords3 versions
pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Tumbleweed pkg:apk/chainguard/bouncycastle-fips
< 1.85-160000.1.1+ 2 more
- (no CPE)range: < 1.85-160000.1.1
- (no CPE)range: < 1.85-1.1
- (no CPE)range: < 2.1.3-r0
Legion Of The Bouncy Castle Inc./Bc Javallm-create
Range: <1.85, <2.73.12, <2.0.2, <2.1.3
Legion Of The Bouncy Castle Inc./Bouncy Castle for Java FIPS (BC-FJA)llm-create
Range: <2.0.2, <2.1.3

Patches

Vulnerability mechanics

References

github.com/bcgit/bc-java/commit/add5f822660f3b2c29fd824e2f4095469c42a1c7nvdPatch

News mentions

Bouncy Castle for Java: 25 Vulnerabilities Disclosed Together on August 3, 2026
Vypr Intelligence · Aug 3, 2026
Bouncy Castle for Java: 25 Vulnerabilities Disclosed in Single Batch on August 3, 2026
Vypr Intelligence · Aug 3, 2026

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000