VYPR
Published Aug 3, 2026· Updated Aug 9, 2026· 1 source

Bouncy Castle for Java: 25 Vulnerabilities Disclosed Together on August 3, 2026

Key findings • 25 vulnerabilities disclosed for Bouncy Castle for Java on August 3, 2026, affecting versions prior to 1.85. • Batch includes Critical and High severity flaws impacting core cr…

Key findings

  • 25 vulnerabilities disclosed for Bouncy Castle for Java on August 3, 2026, affecting versions prior to 1.85.
  • Batch includes Critical and High severity flaws impacting core cryptographic functions and protocols.
  • Vulnerabilities span denial-of-service, data forgery, and certificate validation bypasses.
  • Affected versions include standard, LTS, and FIPS variants of Bouncy Castle for Java.
  • Prompt patching to version 1.85 or later is essential for all users.

On August 3, 2026, a coordinated disclosure event saw 25 vulnerabilities released for Bouncy Castle for Java, affecting versions prior to 1.85. The batch, disclosed within a three-hour window, highlights critical flaws across various cryptographic functions and protocols, including OpenPGP, DTLS, and PKCS#12. These vulnerabilities range in severity from Medium to Critical, with many posing risks of denial-of-service, data forgery, unbounded memory allocation, and certificate validation bypasses.

The disclosed vulnerabilities impact multiple variants of Bouncy Castle for Java, including the standard, Long-Term Support (LTS), and Federal Information Processing Standards (FIPS) editions. Specifically, the LTS version is affected up to 2.73.12, while FIPS variants have specific affected versions depending on the module (e.g., bc-fips, bcpg-fips, bcpkix-fips, bctls-fips, bcmail-fips, bcjmail-fips, bcutil-fips).

Several high-severity vulnerabilities were identified in core cryptographic operations:

  • **CVE-2026-14682**: A potential Out-of-Memory (OOM) condition due to unbounded upfront allocation during definite-length reads.
  • **CVE-2026-13506**: A flaw related to lazy ASN.1 sequence processing that bypasses nesting-depth guards.
  • **CVE-2026-12860**: An RSA PKCS#1 verification issue where the last two hash bytes are skipped in a NULL-omitted path.
  • **CVE-2026-12817**: OpenPGP AEAD decryption that skips the final tag on chunk-aligned data.
  • **CVE-2026-12816**: An IESEngine stream-mode MAC forgery vulnerability stemming from a length-dependent KDF split.
  • **CVE-2026-12803**: A KCCMBlockCipher MAC vulnerability that fails to bind the nonce when AAD is absent, leading to cross-nonce AEAD forgery.
  • **CVE-2026-58061**: CCM-family modes that write plaintext to the caller buffer before the tag check.
  • **CVE-2026-58060**: An HSS public-key level count that is unbounded, enabling huge allocations during verification.
  • **CVE-2026-59646**: A DTLS handshake reassembler that allocates a buffer from an unchecked 24-bit length.
  • **CVE-2026-59645**: An OER parser that recurses without a depth limit on self-referential IEEE 1609.2 schemas.
  • **CVE-2026-59642**: A CMS AuthenticatedData content that is not bound to the MAC when authentication attributes are present.
  • **CVE-2026-59640**: An OpenPGP CFB quick-check oracle active on symmetric/session-key paths.

Critical vulnerabilities also emerged, posing significant risks:

  • **CVE-2026-58062**: A critical issue where a stapled OCSP response is accepted without binding to the checked certificate.
  • **CVE-2026-8763**: A Name Constraints bypass vulnerability that occurs via a trailing dot in rfc822Name and URI.
  • **CVE-2026-59650**: A critical flaw in MTI/A0 DH agreement where an unvalidated peer value is exponentiated.

Medium severity issues include denial-of-service vectors and potential forgeries:

  • **CVE-2026-13586**: A PKCS#12 MAC and bag-decryption KDF iteration-count bound that can lead to DoS.
  • **CVE-2026-58063**: A BCFKS keystore load that honors an unbounded KDF cost from an untrusted file.
  • **CVE-2026-59648**: An OpenPGP Argon2 S2K implementation that honors attacker-chosen memory and passes.
  • **CVE-2026-59647**: A CRMF/CMP password-MAC that honors an unbounded iteration count.

Other notable vulnerabilities include **CVE-2026-12802, where CMS AuthEnvelopedData fails to enforce tag-length on decryption, and CVE-2026-59651, where the BKS keystore accepts a legacy version with a 16-bit integrity MAC key. CVE-2026-59641 involves an S/MIME validator trusting signer-asserted signingTime for path validation, and CVE-2026-13506** relates to lazy ASN.1 sequence processing.

Users of Bouncy Castle for Java are strongly advised to update to patched versions as soon as possible. The standard Java version should be updated to 1.85 or later. Specific patch versions for LTS and FIPS variants are detailed in the vendor's advisories, with affected versions generally being prior to 1.85 for the standard release and specific version ranges for LTS and FIPS modules. Prompt patching is essential to mitigate the widespread security risks presented by this large batch of vulnerabilities. Vypr Intelligence

Synthesized by Vypr AI