Threats affecting pkg:github/bcmls

CVE-2026-17507 is a high-severity vulnerability in Bouncy Castle for Java versions 1.73 up to but not including 1.86. It involves a signed to unsigned conversion error in the MLS implementation where a uint32 leaf_index is stored as a signed int, causing negative values to be misinterpreted. This flaw allows an out-of-range sender to bypass membership checks, potentially leading to a denial of service by exhausting the JVM heap through unbounded node list growth. The issue is fixed by interpreting the leaf_index as unsigned, rejecting out-of-range senders while preserving correct handling of valid indices.

CVE-2026-59644 is a high-severity vulnerability in Bouncy Castle for Java (BC-JAVA) versions before 1.85. It involves the MLS hash-ratchet honoring an arbitrary 32-bit generation counter from the sender, leading to excessive iteration. This flaw is categorized under CWE-834 (Excessive Iteration).