Search: CVE-2026-59649

CVE-2026-59649 is a high severity vulnerability in Bouncy Castle for Java (BC-JAVA) involving memory allocation with an excessive size value. Specifically, the OpenPGP user-attribute subpacket length is only bounded by the JVM's maximum memory, potentially leading to excessive memory allocation. This affects versions before 1.85, as well as certain 2.x LTS and FIPS series versions prior to specified patch releases.