High severity7.5OSV Advisory· Published Aug 3, 2026· Updated Aug 28, 2026
CVE-2026-59642
CVE-2026-59642
Description
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- Range: r2rv73dot11, r2rv73dot10, r2rv73dot9, …
- osv-coords2 versionspkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Tumbleweed
< 1.85-160000.1.1+ 1 more
- (no CPE)range: < 1.85-160000.1.1
- (no CPE)range: < 1.85-1.1
- Range: <1.85, <2.73.12, <1.0.12, <2.0.12, <2.1.12
- Range: <1.0.12, <2.0.12, <2.1.12
Patches
Vulnerability mechanics
References
1News mentions
2- Bouncy Castle for Java: 25 Vulnerabilities Disclosed Together on August 3, 2026Vypr Intelligence · Aug 3, 2026
- Bouncy Castle for Java: 25 Vulnerabilities Disclosed in Single Batch on August 3, 2026Vypr Intelligence · Aug 3, 2026