Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-59649

OpenPGP user-attribute subpacket length bounded only by JVM max memory

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Legion Of The Bouncy Castle Inc.
Products
Bc-java Bcpg-fips Bouncy Castle For Java Lts and 3 more
CVE-2026-12817

OpenPGP AEAD decryption skips final tag on chunk-aligned data

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Legion Of The Bouncy Castle Inc.
Products
Bc-java Bcpg-fips Bouncy Castle For Java Lts and 3 more
CVE-2026-59648

OpenPGP Argon2 S2K honours attacker-chosen memory and passes

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Legion Of The Bouncy Castle Inc.
Products
Bc-java Bcpg-fips Bouncy Castle For Java Lts and 3 more
CVE-2026-59640

OpenPGP CFB quick-check oracle active on symmetric/session-key paths

In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Legion Of The Bouncy Castle Inc.
Products
Bc-java Bcpg-fips Bouncy Castle For Java Lts and 3 more