TI-2026-41816 Aliases CVE-2026-58062 GHSA-j295-77c3-9frf

Stapled OCSP response accepted without binding to the checked certificate

MEDIUM 48CWE-295Published 2026-08-03 · Updated 2026-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 13 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00364 30th percentileScored 2026-11-07

Fix Partial BC-JAVA (Legion of the Bouncy Castle Inc.): 1.85BC-LTS-JAVA (Legion of the Bouncy Castle Inc.): 2.73.12+1 more productRed Hat: 13 advisoriesRed Hat: 13 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Legion of the Bouncy Castle Inc.	BC-JAVA	1.66 to before 1.85	1.85	Patch available	CNA
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	2.73.0 to before 2.73.12	2.73.12	Patch available	CNA
Legion of the Bouncy Castle Inc.	BC-FJA	2.0.0 to before 2.0.2; 2.1.0 to before 2.1.3	2.0.2, 2.1.3	Patch available	CNA

BC-JAVA VendorLegion of the Bouncy Castle Inc. Affected 1.66 to before 1.85 Fixed in 1.85 Patch available CNA
BC-LTS-JAVA VendorLegion of the Bouncy Castle Inc. Affected 2.73.0 to before 2.73.12 Fixed in 2.73.12 Patch available CNA
BC-FJA VendorLegion of the Bouncy Castle Inc. Affected 2.0.0 to before 2.0.2; 2.1.0 to before 2.1.3 Fixed in 2.0.2, 2.1.3 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:bouncycastle:bc-java::::::::	1.66 to before 1.85	Vulnerable	Legion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts::::::::	up to 2.73.11	Vulnerable	Legion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:fips_java_api::::::::	before 2.0.2; 2.1.0 to before 2.1.3	Vulnerable	Legion of the Bouncy Castle Inc.

cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions 1.66 to before 1.85 Vulnerable ·Legion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:* Versions up to 2.73.11 Vulnerable ·Legion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:* Versions before 2.0.2; 2.1.0 to before 2.1.3 Vulnerable ·Legion of the Bouncy Castle Inc.

Remediation

Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.85
Fix · CNA BC-LTS-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 2.73.12
Fix · CNA BC-FJA (Legion of the Bouncy Castle Inc.) Fixed in 2.0.2, 2.1.3

Red Hat 13 advisories

RHSA-2026:95887 Released 2026-11-06 · Red Hat rating Important
Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Red Hat JBoss Enterprise Application Platform 8.1
RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
Red Hat OpenShift Dev Spaces 3.31.0 Release.
- Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9

Show 10 more Red Hat advisories

RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-03
Legion of the Bouncy Castle BC-JAVA 1.85
32 records Highest priority Priority MEDIUM 23 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer valuePriority MEDIUM 48
- TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-inPriority MEDIUM 48
- TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URIPriority MEDIUM 48
Show all 32 records →
Release · 2026-08-03
Legion of the Bouncy Castle BC-LTS-JAVA 2.73.12
28 records Highest priority Priority MEDIUM 20 MEDIUM, 8 LOW
Other records, highest priority first
- TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer valuePriority MEDIUM 48
- TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-inPriority MEDIUM 48
- TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URIPriority MEDIUM 48
Show all 28 records →

Show 1 more group

Release · 2026-08-03
Legion of the Bouncy Castle BC-FJA 2.0.2, 2.1.3
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-41814 HSS public-key level count unbounded, enabling huge allocation on verifyPriority MEDIUM 45
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Developer Tools and Services	Affected	No fix yet
Red Hat AMQ Broker 7	Affected	No fix yet
Red Hat Build of Keycloak	Affected	No fix yet
Red Hat Ceph Storage 9	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix planned: Out of support scope
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet
Red Hat Single Sign-On 7	Affected	No fix planned: Will not fix
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet
Red Hat build of Apicurio Registry 3	Affected	No fix yet
OpenShift Developer Tools and Services 4.12	Fixed	RHSA-2026:88152
OpenShift Developer Tools and Services 4.13	Fixed	RHSA-2026:88149
OpenShift Developer Tools and Services 4.14	Fixed	RHSA-2026:88151
OpenShift Developer Tools and Services 4.15	Fixed	RHSA-2026:88150
OpenShift Developer Tools and Services 4.16	Fixed	RHSA-2026:88156
OpenShift Developer Tools and Services 4.17	Fixed	RHSA-2026:88159
OpenShift Developer Tools and Services 4.18	Fixed	RHSA-2026:88153
OpenShift Developer Tools and Services 4.19	Fixed	RHSA-2026:88158
OpenShift Developer Tools and Services 4.20	Fixed	RHSA-2026:88157
OpenShift Developer Tools and Services 4.21	Fixed	RHSA-2026:88155
OpenShift Developer Tools and Services 4.22	Fixed	RHSA-2026:88154
Red Hat JBoss Enterprise Application Platform 8.1	Fixed	RHSA-2026:95887
Red Hat OpenShift Dev Spaces 3.31	Fixed	RHSA-2026:90321

Not affected: 20 products

OpenShift Developer Tools and Services 4.12
OpenShift Developer Tools and Services 4.13
OpenShift Developer Tools and Services 4.14
OpenShift Developer Tools and Services 4.15
OpenShift Developer Tools and Services 4.16
OpenShift Developer Tools and Services 4.17
OpenShift Developer Tools and Services 4.18
OpenShift Developer Tools and Services 4.19
OpenShift Developer Tools and Services 4.20
OpenShift Developer Tools and Services 4.21
OpenShift Developer Tools and Services 4.22
Red Hat AMQ Clients
Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat OpenShift Dev Spaces 3.31
Red Hat Satellite 6
Red Hat build of Apache Camel 4 for Quarkus 3
Red Hat build of Quarkus

Timeline

2026-10-02 Threatist record created from CVE-2026-58062
2026-10-03 Alias added: GHSA-j295-77c3-9frf
2026-10-16 Affected versions changed · Red Hat
2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
2026-11-06 Fix available: RHSA-2026:95887 · Red Hat
2026-11-06 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat

References

Patch 2

TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
TI-2007-06415 The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in… CVSS 2.0HIGH 10.0

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences