Read the docs
TI-2026-04899 Aliases CVE-2026-5588GHSA-wg6q-6289-32hp

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

Priority LOW 35CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 29 fixed, 9 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.

Summary

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00777 56th percentileScored 2026-11-07
Fix Partial BC-JAVA (Legion of the Bouncy Castle Inc.): 1.80.2, 1.81.1, 1.84BCPKIX-FIPS (Legion of the Bouncy Castle Inc.): 2.0.11, 2.1.11+8 more productsRed Hat: 31 advisoriesRed Hat: 29 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Legion of the Bouncy Castle Inc.BC-JAVA1.67 to before 1.80.2; 1.81 to before 1.81.1; 1.82 to before 1.841.80.2, 1.81.1, 1.84Patch availableCNA
Legion of the Bouncy Castle Inc.BCPKIX-FIPS2.0.6 to before 2.0.11; 2.1.7 to before 2.1.112.0.11, 2.1.11Patch availableCNA
Legion of the Bouncy Castle Inc.BCPIX-LTS2.73.7 to before 2.73.112.73.11Patch availableCNA
—org.bouncycastle:bcpkix-jdk18on (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
—org.bouncycastle:bcpkix-jdk15to18 (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
—org.bouncycastle:bcpkix-jdk15on (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
—org.bouncycastle:bcpkix-jdk14 (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
—org.bouncycastle:bcpkix-debug-jdk18on (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
—org.bouncycastle:bcpkix-debug-jdk15to18 (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
—org.bouncycastle:bcpkix-debug-jdk14 (Maven)1.49 to before 1.841.84Patch availableGHSA-wg6q-6289-32hp
  • BC-JAVA VendorLegion of the Bouncy Castle Inc. Affected 1.67 to before 1.80.2; 1.81 to before 1.81.1; 1.82 to before 1.84 Fixed in 1.80.2, 1.81.1, 1.84 Patch available CNA
  • BCPKIX-FIPS VendorLegion of the Bouncy Castle Inc. Affected 2.0.6 to before 2.0.11; 2.1.7 to before 2.1.11 Fixed in 2.0.11, 2.1.11 Patch available CNA
  • BCPIX-LTS VendorLegion of the Bouncy Castle Inc. Affected 2.73.7 to before 2.73.11 Fixed in 2.73.11 Patch available CNA
  • org.bouncycastle:bcpkix-jdk18on (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp
  • org.bouncycastle:bcpkix-jdk15to18 (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp
  • org.bouncycastle:bcpkix-jdk15on (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp
  • org.bouncycastle:bcpkix-jdk14 (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp
  • org.bouncycastle:bcpkix-debug-jdk18on (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp
  • org.bouncycastle:bcpkix-debug-jdk15to18 (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp
  • org.bouncycastle:bcpkix-debug-jdk14 (Maven) Vendor— Affected 1.49 to before 1.84 Fixed in 1.84 Patch available GHSA-wg6q-6289-32hp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*——Legion of the Bouncy Castle Inc.

Remediation

  • Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.80.2, 1.81.1, 1.84
  • Fix · CNA BCPKIX-FIPS (Legion of the Bouncy Castle Inc.) Fixed in 2.0.11, 2.1.11
  • Fix · CNA BCPIX-LTS (Legion of the Bouncy Castle Inc.) Fixed in 2.73.11
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-jdk18on (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-jdk15to18 (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-jdk15on (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-jdk14 (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-debug-jdk18on (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-debug-jdk15to18 (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-wg6q-6289-32hp org.bouncycastle:bcpkix-debug-jdk14 (Maven) Fixed in 1.84 Advisory →

Red Hat 31 advisories

  • RHSA-2026:76128 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el7sso
  • RHSA-2026:76130 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso
  • RHSA-2026:76129 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el8sso
Show 28 more Red Hat advisories
  • RHSA-2026:76134 Released 2026-10-05 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2026:76132 Released 2026-10-05 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update
    • Red Hat Single Sign-On 7.6.13
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:53806 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.25
  • RHSA-2026:53646 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
  • RHSA-2026:53645 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
  • RHSA-2026:53644 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
  • RHSA-2026:17668 Released 2026-05-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • RHSA-2026:14276 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.7 release and security update
    • Red Hat AMQ Broker 7.12.7
  • RHSA-2026:14272 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.5 release and security update
    • Red Hat AMQ Broker 7.13.5
  • RHSA-2026:13631 Released 2026-05-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)
    • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • RHSA-2026:11720 Released 2026-05-05 · Red Hat rating Important
    Red Hat build of Quarkus 3.20.6.SP1 security update
    • Red Hat build of Quarkus 3.20.6.SP1 io.quarkus.quarkus-vertx-http-3.20.6.redhat-00003.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.84.0.redhat-00001.jar
  • RHSA-2026:11721 Released 2026-05-05 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.3.SP1 security update
    • Red Hat build of Quarkus 3.27.3.SP1 io.quarkus.quarkus-vertx-http-3.27.3.redhat-00002.jar, org.apache.kafka.kafka-clients-4.0.2.redhat-00001.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Legion of the Bouncy Castle BC-JAVA 1.80.2, 1.81.1, 1.84

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-04906 Non-constant time comparisons risk private key leakage in FrodoKEM.Priority MEDIUM 48
    • TI-2026-03020 Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.Priority MEDIUM 45
    • TI-2025-13517 GOSTCTR implementation unable to process more than 255 blocks correctlyPriority MEDIUM 42
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2026:76134
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat AMQ Broker 7.12.7Fixed RHSA-2026:14276
Red Hat AMQ Broker 7.13.5Fixed RHSA-2026:14272
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27Fixed RHSA-2026:13631
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:53644
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:18055
Red Hat JBoss Enterprise Application Platform 7.4.25Fixed RHSA-2026:53806
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2026:76128
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2026:76129
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2026:76130
Red Hat Single Sign-On 7.6.13Fixed RHSA-2026:76132
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14Fixed RHSA-2026:17668
Red Hat build of Quarkus 3.20.6.SP1Fixed RHSA-2026:11720
Red Hat build of Quarkus 3.27.3.SP1Fixed RHSA-2026:11721
Not affected: 27 products
  • Cryostat 4
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Satellite 6
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Quarkus 3.20.6.SP1
  • Red Hat build of Quarkus 3.27.3.SP1
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5588
  2. 2026-10-03 Alias added: GHSA-wg6q-6289-32hp
  3. 2026-10-06 Fix available: RHSA-2026:76134 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76132 · Red Hat
  5. 2026-10-06 Fix available: RHSA-2026:76129 · Red Hat
  6. 2026-10-06 Fix available: RHSA-2026:76130 · Red Hat
  7. 2026-10-06 Fix available: Middleware Containers for OpenShift, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9 +1 · Red Hat
  8. 2026-10-07 Fix available: RHSA-2026:76128 · Red Hat
  9. 2026-10-07 Fix available: Red Hat Single Sign-On 7.6 for RHEL 7 Server · Red Hat
  10. 2026-10-09 Fix available: RHSA-2026:13631 · Red Hat
  11. 2026-10-09 Fix available: RHSA-2026:14272 · Red Hat
  12. 2026-10-09 Fix available: Red Hat AMQ Broker 7.13.5, Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · Red Hat
  13. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  14. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA · Red Hat
  15. 2026-10-21 Affected versions changed · Red Hat
  16. 2026-10-30 Affected versions changed · Red Hat
  17. 2026-11-01 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
  • TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
  • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
  • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
  • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
  • TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences