Threat Intelligence Database

CVE-2026-71884 is a high severity vulnerability in Legion of the Bouncy Castle Inc.'s BC-LTS-JAVA library versions 2.73.4 up to but not including 2.73.13. The native one-shot CTR packet cipher implementation did not validate that the input length fit within the counter space derived from the IV, causing the counter to wrap and the keystream to repeat. This results in two segments of the ciphertext being encrypted under the same keystream, allowing plaintext recovery without the key. The issue is fixed by preflight validation rejecting over-long requests before processing. The streaming implementation and portable AESCTRPacketCipher were not affected. Bouncy Castle for Java (bcprov) is unaffected as it lacks native implementations.

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

CVE-2026-12185 is a high severity vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library. It involves memory allocation with excessive size values in BKS/UBER keystore implementations before integrity checks are performed. This affects versions prior to 1.85 and versions from 2.73.0 up to but not including 2.73.12.

CVE-2026-13506 is a high severity vulnerability in Bouncy Castle for Java (BC-JAVA) involving uncontrolled recursion due to a Lazy ASN.1 sequence forcing that resets the nesting-depth guard. This affects versions before 1.85 and certain LTS and FIPS versions prior to specified fixed releases. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant impact if exploited. No official patch or remediation level is currently confirmed from the vendor advisory. No known exploits are reported in the wild.

CVE-2026-59650 is a critical vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library affecting versions before 1.85 and LTS versions from 2.73.0 up to but not including 2.73.12. The flaw involves improper input validation in the MTI/A0 Diffie-Hellman agreement process, where an unvalidated peer value is exponentiated. This can lead to severe cryptographic failures. The vulnerability has a high CVSS 4.0 score of 9.3, indicating network exploitable with no privileges or user interaction required. No official patch or remediation guidance is currently confirmed from the vendor advisory. There are no known exploits in the wild at this time.

CVE-2026-59651 is a vulnerability in Bouncy Castle for Java (BC-JAVA) affecting versions before 1.85 and LTS versions from 2.73.0 up to but not including 2.73.12. The issue involves the BKS keystore accepting a legacy version that uses a 16-bit integrity MAC key, which is considered inadequate encryption strength. This weakness could potentially undermine the integrity protection of the keystore data.

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C. This issue affects BC-LTS: from 2.73.0 before 2.73.12.1. Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.