Threats Tagged 'cve-2026-59638'

A security update for BouncyCastle version 1.85 addresses multiple critical vulnerabilities affecting cryptographic operations, keystore handling, and data validation. These issues include bypasses, memory allocation flaws, MAC forgery, improper verification, and denial-of-service risks. The update also repackages certain post-quantum cryptography algorithms and deprecates older versions. No specific affected versions are stated beyond the update to 1.85.

CVE-2026-12185 is a high severity vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library. It involves memory allocation with excessive size values in BKS/UBER keystore implementations before integrity checks are performed. This affects versions prior to 1.85 and versions from 2.73.0 up to but not including 2.73.12.

Bouncy Castle for Java versions prior to 1.85 have a security vulnerability where the JSSE hostname verifier's CN-fallback is enabled by default, contrary to the documented opt-in behavior. This affects multiple Bouncy Castle Java variants including LTS and FIPS versions before specified patch releases. The vulnerability relates to improper hostname verification, which can impact confidentiality, integrity, and availability.

CVE-2026-59638 is a critical vulnerability in Bouncy Castle for Java where the JSSE hostname verifier CN-fallback is enabled by default despite being documented as opt-in. This affects versions before 1.85, including LTS versions before 2.73.12 and FIPS versions before specified patch releases. The flaw involves improper validation of certificates with host mismatches, categorized under CWE-297.