Legion of the Bouncy Castle Inc.

Records110All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high68CVSS 7.0–8.9

Exploited now

Legion of the Bouncy Castle Inc. records in CISA KEV

No Legion of the Bouncy Castle Inc. vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Bcpg-fips · all components

TI-2026-42544 CVE-2026-59649 · GHSA-r7h8-35pv-fwgx

MEDIUM 44

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-789

TI-2026-42535 CVE-2026-59640 · GHSA-w983-hf44-gcww

MEDIUM 44

In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00347 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-203

TI-2026-42538 CVE-2026-59643 · GHSA-r7xx-x336-xqqr

MEDIUM 43

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00242 Published 2026-08-03 Partial fix · 1.85, 2.0.13 CWE-347

TI-2026-10955 CVE-2026-12817 · GHSA-9q38-7pr7-8j6w

MEDIUM 43

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00169 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-354

TI-2026-42543 CVE-2026-59648 · GHSA-p3f8-5jpx-fgqm

LOW 31

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-770