The vulnerability CVE-2026-59650 in BC-JAVA arises from improper input validation (CWE-20) during the MTI/A0 Diffie-Hellman key agreement. Specifically, the implementation exponentiates a peer value without validating it first, which could lead to security issues. This affects BC-JAVA versions prior to 1.85 and LTS versions from 2.73.0 up to 2.73.12. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, but with high impact on confidentiality and integrity. The vendor has not yet provided an official fix or remediation level. The vulnerability is published and recognized but no active exploitation has been reported.

Successful exploitation of this vulnerability could compromise the confidentiality and integrity of cryptographic operations relying on the MTI/A0 Diffie-Hellman agreement in affected BC-JAVA versions. This may allow attackers to manipulate key agreement processes, potentially undermining secure communications or cryptographic protections. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding affected versions or applying any recommended workarounds from the vendor. Monitor official Legion of the Bouncy Castle Inc. communications for updates on patches or mitigations.