DeutschShown in its original language — a full translation is planned for a future version.
Bouncy Castle für Java: Mehrere Schwachstellen
view advisory published 2026-10-04
Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle für Java ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-97873US | — | — | ||
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration coun… | ||||
| CVE-2026-85515US | —OT elevated | — | ||
In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed… | ||||
| CVE-2026-71892US | — | — | ||
In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true),… | ||||
| CVE-2026-71891US | — | — | ||
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and a… | ||||
| CVE-2026-71890US | —OT elevated | — | ||
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted… | ||||
| CVE-2026-71889US | — | — | ||
In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathRev… | ||||
| CVE-2026-71888US | — | — | ||
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticate… | ||||
| CVE-2026-71887US | —OT elevated | — | ||
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key… | ||||
| CVE-2026-71886US | —OT elevated | — | ||
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certifi… | ||||
| CVE-2026-71885US | — | — | ||
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify()… | ||||
| CVE-2026-71883US | — | — | ||
In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authentica… | ||||
| CVE-2026-18040US | — | — | ||
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cac… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:83082 vom 2026-10-15external
- Red Hat Security Advisory RHSA-2026:83520 vom 2026-10-15external
- Red Hat Security Advisory RHSA-2026:83670 vom 2026-10-16external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan