{"kind": "product", "path": "vulns/debian-12/bouncycastle", "name": "bouncycastle", "product": "bouncycastle", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-71890", "noindex": false, "published": "2026-10-03T08:57:00.965Z", "modified": "2026-10-05T15:58:20.685Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00249, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71890", "title": "MLS external commit can remove an arbitrary group member", "description": "In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to do with the joiner. RFC 9420 sec. 12.2 permits at most one Remove proposal in an external commit, with which the joiner removes an old version of themselves, and requires that where one is present the LeafNode in the commit's path field meet the criteria it would have to meet in an Update for the removed leaf, in particular that its credential presen", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071890", "https://github.com/bcgit/bc-java/commit/7e8bb10eb90baddf3f10b8679f627462b9522d24", "https://nvd.nist.gov/vuln/detail/CVE-2026-71890"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71891", "noindex": false, "published": "2026-10-03T08:56:01.050Z", "modified": "2026-10-05T15:59:26.486Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00174, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71891", "title": "BLS12-381 key validation accepts a public key built on a foreign curve", "description": "In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field characteristic. The prime-order subgroup check trusts a point's own curve to name its cofactor, since ECPoint.satisfiesOrder returns true outright when the curve's cofactor is one, so a point on a curve with a different equation and a cofactor forged to one passed keyValidate despite not being a G1 point at all. In BC's pairing implementation such a ", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891", "https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb", "https://nvd.nist.gov/vuln/detail/CVE-2026-71891"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-18040", "noindex": false, "published": "2026-10-03T08:55:06.766Z", "modified": "2026-10-05T16:00:20.062Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00107, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18040", "title": "HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler", "description": "In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithm", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018040", "https://github.com/bcgit/bc-java/commit/283acd81048ec9e951032525279d3b58aaf0bb03", "https://nvd.nist.gov/vuln/detail/CVE-2026-18040"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71885", "noindex": false, "published": "2026-10-03T08:51:53.292Z", "modified": "2026-10-05T16:01:11.470Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "critical", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71885", "title": "MLS X.509 credential not bound to the LeafNode signature key", "description": "In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. A party could therefore present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that o", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071885", "https://github.com/bcgit/bc-java/commit/77632a57edf350a7b5751fca1a5052daffa8dab2", "https://nvd.nist.gov/vuln/detail/CVE-2026-71885"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71886", "noindex": false, "published": "2026-10-03T08:46:33.868Z", "modified": "2026-10-05T16:03:23.403Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71886", "title": "OpenPGP certification accepted from a subkey without certification authority", "description": "In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify. OpenPGPCertificate.getCertificationBy() and getDelegationBy() resolve a third-party signature by matching its issuer key identifier against every key of the third-party certificate, then verify the issuing component's binding chain and the signature itself; nothing checked that the issuing component carried the RFC 9580 sec. 5.2.3.29 certification key flag (CERTIFY_OTHER) when the ", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071886", "https://github.com/bcgit/bc-java/commit/f0d5c8535aeff3f34b7b6b6289ee78c2ea36a3fb", "https://nvd.nist.gov/vuln/detail/CVE-2026-71886"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71887", "noindex": false, "published": "2026-10-03T08:39:07.997Z", "modified": "2026-10-05T16:04:21.150Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.0009, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71887", "title": "OpenPGP data signature accepted from a signing subkey without cross-certification", "description": "In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec. 5.2.1.8 and sec. 10.1.3 require the embedded Primary Key Binding signature on any subkey that can issue signatures; it is the subkey's own statement that it belongs to the primary key it is bound under. OpenPGPCertificate resolved the subkey's key flags two different ways. isSigningKey() goes through getKeyFlags() and getApplyingSubpacket(), which falls", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071887", "https://github.com/bcgit/bc-java/commit/b51452fa48ccb578fc16b8222fce9eedf92c94d6", "https://nvd.nist.gov/vuln/detail/CVE-2026-71887"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71888", "noindex": false, "published": "2026-10-03T08:36:12.960Z", "modified": "2026-10-05T16:52:07.424Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00112, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71888", "title": "CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent", "description": "In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with ", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888", "https://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95", "https://nvd.nist.gov/vuln/detail/CVE-2026-71888"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71889", "noindex": false, "published": "2026-10-03T08:31:01.178Z", "modified": "2026-10-05T16:57:32.912Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71889", "title": "PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate", "description": "In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints ext", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071889", "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85", "https://nvd.nist.gov/vuln/detail/CVE-2026-71889"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-71892", "noindex": false, "published": "2026-10-03T08:30:26.982Z", "modified": "2026-10-05T16:58:40.411Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00173, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-71892", "title": "CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys", "description": "In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256). The branch that should have selected the actual content-encryption algorithm carried in the key derivation AlgorithmIdentifier's parameters compared the encrypted-key byte array against the id-alg-cek-hkdf-sha256 object identifier, a comparison between a byte array and an ASN1ObjectIdentifier that is false for every possible input, so the check fell through to a key-si", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071892", "https://github.com/bcgit/bc-java/commit/be0a7d925c818ef2f338bcec55178b9b6336dfc3", "https://nvd.nist.gov/vuln/detail/CVE-2026-71892"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-85515", "noindex": false, "published": "2026-10-03T08:05:16.553Z", "modified": "2026-10-05T18:04:19.704Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-85515", "title": "OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check", "description": "In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when streaming but requires it to indicate a clear error as soon as the truncation is detected, and to report suspect integrity when it discovers malleable ciphertext. The truncation was detected and then discarded: when a message is truncated but the length field of the enclosing packet is left unchanged, BCPGInputStream.PartialInputStream raises an EOFEx", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9085515", "https://github.com/bcgit/bc-java/commit/ab7a235d1c20e3da28ce77167a96b5c14025efa7", "https://nvd.nist.gov/vuln/detail/CVE-2026-85515"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-97873", "noindex": false, "published": "2026-10-03T08:04:43.322Z", "modified": "2026-10-05T17:00:58.750Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00263, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-97873", "title": "Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider", "description": "In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count from an encoded PKCS12PBEParams or PBEParameter, narrowing a value beyond the int range with intValue(), and every Cipher, Mac and SecretKeyFactory in these families derived with whatever count it was given, i", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9097873", "https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1", "https://nvd.nist.gov/vuln/detail/CVE-2026-97873"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-18036", "noindex": false, "published": "2026-10-02T07:54:16.063Z", "modified": "2026-10-02T17:42:56.393Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00282, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18036", "title": "NTRU leaks private key information by reducing secret values with a non-constant-time integer division", "description": "In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomia", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9018036", "https://github.com/bcgit/bc-java/commit/9c9ad88b6003bb6230d2434bd892cc1e95b294e4", "https://nvd.nist.gov/vuln/detail/CVE-2026-18036"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-17508", "noindex": false, "published": "2026-10-02T07:27:59.519Z", "modified": "2026-10-02T17:43:24.578Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00418, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-17508", "title": "Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points", "description": "In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost gua", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9017508", "https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a", "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-17507", "noindex": false, "published": "2026-10-02T07:26:34.739Z", "modified": "2026-10-02T17:43:56.738Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.0042, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-17507", "title": "MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender", "description": "In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an u", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9017507", "https://github.com/bcgit/bc-java/commit/1eb83471eb01727bfdb944a5a46355cc77d55f44", "https://nvd.nist.gov/vuln/detail/CVE-2026-17507"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-13586", "noindex": false, "published": "2026-08-03T02:58:00.982Z", "modified": "2026-08-03T15:03:49.757Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber", "severity": "medium", "epss": 0.00616, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-13586", "title": "PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)", "description": "In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013586", "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96", "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-13506", "noindex": false, "published": "2026-08-03T02:56:49.476Z", "modified": "2026-08-03T15:09:01.597Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00493, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-13506", "title": "Lazy ASN.1 sequence forcing resets nesting-depth guard", "description": "In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).", "references": ["https://github.com/bcgit/bc-java/wiki/CVE-2026-13506", "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84", "https://nvd.nist.gov/vuln/detail/CVE-2026-13506"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-12860", "noindex": false, "published": "2026-08-03T02:55:58.379Z", "modified": "2026-08-03T15:10:17.181Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12860", "title": "RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path", "description": "In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012860", "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396", "https://nvd.nist.gov/vuln/detail/CVE-2026-12860"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-12852", "noindex": false, "published": "2026-08-03T02:55:02.485Z", "modified": "2026-08-03T15:11:39.086Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00493, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12852", "title": "MLS wire decoder allocates attacker-declared opaque length before bounds check", "description": "In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012852", "https://github.com/bcgit/bc-java/commit/a747038bb5bbd5e29fb2b7607ab38af1fd8d1790", "https://nvd.nist.gov/vuln/detail/CVE-2026-12852"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-12817", "noindex": false, "published": "2026-08-03T02:54:16.880Z", "modified": "2026-08-03T15:15:27.099Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00169, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12817", "title": "OpenPGP AEAD decryption skips final tag on chunk-aligned data", "description": "In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012817", "https://github.com/bcgit/bc-java/commit/4b712819846ec944379f4909101abac20f0ad4b0", "https://nvd.nist.gov/vuln/detail/CVE-2026-12817"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-12816", "noindex": false, "published": "2026-08-03T02:53:32.240Z", "modified": "2026-08-03T15:21:22.986Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber", "severity": "high", "epss": 0.00179, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12816", "title": "IESEngine stream-mode MAC forgery via length-dependent KDF split", "description": "In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.", "references": ["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012816", "https://github.com/bcgit/bc-java/commit/6d9e4bbaee9409713ada167e5f901554cbb084ac", "https://nvd.nist.gov/vuln/detail/CVE-2026-12816"], "fixes": [], "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}]}], "total": 83, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 5, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "bouncycastle", "path": "vulns/debian-12/bouncycastle", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 14, "kev": 0}, "lastmod": "2026-10-05T18:04:19.704Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}