This vulnerability (CWE-295) in BC-JAVA occurs because stapled OCSP responses are accepted without verifying that they are bound to the certificate being checked. Affected versions include BC-JAVA before 1.85, BC-JAVA LTS before 2.73.12, and BC-FJA FIPS versions before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No official patch or remediation level is indicated in the available data, and no known exploits in the wild have been reported.

The vulnerability allows acceptance of OCSP responses that are not properly bound to the certificate, potentially enabling attackers to bypass certificate status validation. This can lead to trust in revoked or invalid certificates, compromising secure communications that rely on BC-JAVA for certificate validation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding affected versions or implementing additional certificate validation controls outside of BC-JAVA. Monitor vendor communications for updates on patches or workarounds.