The vulnerability in Bouncy Castle for Java before version 1.85 involves acceptance of stapled OCSP responses without proper binding to the certificate under validation. This means that an OCSP response could be accepted even if it does not correspond to the certificate being checked, violating the expected certificate validation process. The issue extends to Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS before versions 2.0.2 and 2.1.3 in their respective series. This is classified under CWE-295, indicating improper certificate validation.

This vulnerability can lead to incorrect validation of certificates, potentially allowing an attacker to present an OCSP response that is not actually valid for the certificate in question. This undermines the trust model of certificate validation and could facilitate man-in-the-middle attacks or other forms of impersonation where OCSP stapling is used. The severity is critical due to the fundamental role of certificate validation in secure communications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply patches once available. Until then, consider disabling OCSP stapling verification or using alternative certificate validation methods if feasible.