Threats affecting pkg:github/bctls

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.3%	CVE-2026-59638Legion of the Bouncy Castle BC-JAVA · Improper Validation of Certificate with Host Mismatch Critical9.3EPSS 0.3%2026-08-03CVE Database V5CVE-2026-59638 CVE-2026-59638 is a critical vulnerability in Bouncy Castle for Java where the JSSE hostname verifier CN-fallback is enabled by default despite being documented as opt-in. This affects versions before 1.85, including LTS versions before 2.73.12 and FIPS versions before specified patch releases. The flaw involves improper validation of certificates with host mismatches, categorized under CWE-297. EPSS 0.3%Vulnerability CWE-297	CVE Database V5	2026-08-03
High	8.7	EPSS 0.5%	CVE-2026-59646Legion of the Bouncy Castle BC-JAVA · Excessive Memory Allocation High8.7EPSS 0.5%2026-08-03CVE Database V5CVE-2026-59646 A high-severity vulnerability (CVE-2026-59646) exists in Bouncy Castle for Java (BC-JAVA) where the DTLS handshake reassembler allocates a buffer based on an unchecked 24-bit length value. This affects versions before 1.85 and versions from 2.73.0 up to but not including 2.73.12, including certain FIPS series releases. The unchecked allocation can lead to excessive memory allocation, classified under CWE-789. EPSS 0.5%Vulnerability CWE-789	CVE Database V5	2026-08-03

Page 1 of 1