Legion of the Bouncy Castle Inc.

Records110All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high68CVSS 7.0–8.9

Exploited now

Legion of the Bouncy Castle Inc. records in CISA KEV

No Legion of the Bouncy Castle Inc. vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Bcpkix-fips · all components

TI-2026-42537 CVE-2026-59642 · GHSA-cfjh-c47f-gprf

MEDIUM 43

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00303 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-354

TI-2026-42534 CVE-2026-59639 · GHSA-r3rc-x3pq-jmw7

MEDIUM 43

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00242 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-347

TI-2026-10940 CVE-2026-12802 · GHSA-833g-4xxm-r9cx

MEDIUM 43

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00195 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-354

TI-2026-42542 CVE-2026-59647 · GHSA-jjmc-c8fq-qcww

LOW 37

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-770

TI-2026-12671 CVE-2026-15055 · GHSA-mx98-27g8-c9xc

LOW 24

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00339 Published 2026-08-03 Partial fix · 1.85, 2.73.12 +3 CWE-770