Threat Intelligence Database

CVE-2026-13506 is a high severity vulnerability in Bouncy Castle for Java (BC-JAVA) involving uncontrolled recursion due to a Lazy ASN.1 sequence forcing that resets the nesting-depth guard. This affects versions before 1.85 and certain LTS and FIPS versions prior to specified fixed releases. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant impact if exploited. No official patch or remediation level is currently confirmed from the vendor advisory. No known exploits are reported in the wild.

CVE-2026-59651 is a vulnerability in Bouncy Castle for Java (BC-JAVA) affecting versions before 1.85 and LTS versions from 2.73.0 up to but not including 2.73.12. The issue involves the BKS keystore accepting a legacy version that uses a 16-bit integrity MAC key, which is considered inadequate encryption strength. This weakness could potentially undermine the integrity protection of the keystore data.

CVE-2026-59650 is a critical vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library affecting versions before 1.85 and LTS versions from 2.73.0 up to but not including 2.73.12. The flaw involves improper input validation in the MTI/A0 Diffie-Hellman agreement process, where an unvalidated peer value is exponentiated. This can lead to severe cryptographic failures. The vulnerability has a high CVSS 4.0 score of 9.3, indicating network exploitable with no privileges or user interaction required. No official patch or remediation guidance is currently confirmed from the vendor advisory. There are no known exploits in the wild at this time.

CVE-2026-12185 is a high severity vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library. It involves memory allocation with excessive size values in BKS/UBER keystore implementations before integrity checks are performed. This affects versions prior to 1.85 and versions from 2.73.0 up to but not including 2.73.12.