Threats Tagged 'cve-2026-13586'

A security update for BouncyCastle version 1.85 addresses multiple critical vulnerabilities affecting cryptographic operations, keystore handling, and data validation. These issues include bypasses, memory allocation flaws, MAC forgery, improper verification, and denial-of-service risks. The update also repackages certain post-quantum cryptography algorithms and deprecates older versions. No specific affected versions are stated beyond the update to 1.85.

CVE-2026-12185 is a high severity vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library. It involves memory allocation with excessive size values in BKS/UBER keystore implementations before integrity checks are performed. This affects versions prior to 1.85 and versions from 2.73.0 up to but not including 2.73.12.

A vulnerability in Bouncy Castle for Java prior to version 1.85 allows an attacker to exploit the PKCS#12 MAC and bag-decryption KDF iteration-count bound, potentially causing a denial of service (DoS). This issue also affects Bouncy Castle for Java LTS versions before 2.73.12 and various versions of Bouncy Castle for Java FIPS. The vulnerability is categorized under CWE-770, which relates to allocation of resources without limits or throttling. No known exploits are reported in the wild, and no patch information is currently available.