CVE-2026-71891 is a cryptographic signature verification vulnerability in Bouncy Castle for Java versions 1.85 up to but not including 1.86. The flaw allows acceptance of a public key constructed on a non-canonical elliptic curve that mimics the BLS12-381 curve's field characteristic but is not valid. This leads to improper subgroup validation, enabling an aggregate signature to be accepted even when it contains a phantom signer. The issue only occurs if an application explicitly constructs ECPoints on non-standard curves; the default compressed-point decoder is unaffected. The vulnerability is fixed in version 1.86.
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.
CVE-2026-71889 is a vulnerability in Bouncy Castle for Java before version 1.86 and certain LTS and FIPS releases, where improper certificate validation occurs due to failure to apply X.509 name constraints to the end-entity certificate. This flaw allows a certificate chain with a leaf certificate violating the NameConstraints extension imposed by its issuing CA to be incorrectly validated as trusted by the PKIXCertPathReviewer classes. The issue has been fixed in versions 1.86, 2.73.13, 2.1.13, 2.0.13, and 1.0.13.
CVE-2026-97873 is a vulnerability in Bouncy Castle for Java before versions 1.86 and 2.73.13. It involves the legacy PBES1 and PKCS#12 password-based encryption (PBE) schemes running key derivation with an iteration count taken from untrusted input without proper limits. This allows an attacker to specify an arbitrary amount of computational work, potentially causing resource exhaustion. The issue is addressed by bounding the iteration count with a configurable maximum and rejecting out-of-range values.
In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.
In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
CVE-2026-8763 is a critical vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library affecting versions prior to 1.85 and certain LTS and FIPS releases. The flaw involves improper certificate validation, specifically a Name Constraints bypass via a trailing dot in rfc822Name and URI fields. This vulnerability allows attackers to bypass certificate restrictions, potentially undermining TLS/SSL security. It has a high CVSS 4.0 score of 9.3, indicating network exploitable, no privileges required, and no user interaction needed. Fixed versions are available for all affected branches.