Read the docs
TI-2026-42544 Aliases CVE-2026-59649GHSA-r7h8-35pv-fwgx

OpenPGP user-attribute subpacket length bounded only by JVM max memory

Priority MEDIUM 44CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-789.

Summary

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Partial BC-JAVA (Legion of the Bouncy Castle Inc.): 1.85BC-LTS-JAVA (Legion of the Bouncy Castle Inc.): 2.73.12+1 more productRed Hat: 16 advisoriesRed Hat: 16 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Legion of the Bouncy Castle Inc.BC-JAVAbefore 1.851.85Patch availableCNA
Legion of the Bouncy Castle Inc.BC-LTS-JAVA2.73.0 to before 2.73.122.73.12Patch availableCNA
Legion of the Bouncy Castle Inc.BC-FJA1.0.0 to before 1.0.13; 2.0.0 to before 2.0.13; 2.1.0 to before 2.1.131.0.13, 2.0.13, 2.1.13Patch availableCNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*before 1.85VulnerableLegion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:bcpg-fips:*:*:*:*:*:*:*:*before 1.0.13; 2.0.8 to before 2.0.13; 2.1.10 to before 2.1.13VulnerableLegion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*up to 2.73.11VulnerableLegion of the Bouncy Castle Inc.

Remediation

  • Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.85
  • Fix · CNA BC-LTS-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 2.73.12
  • Fix · CNA BC-FJA (Legion of the Bouncy Castle Inc.) Fixed in 1.0.13, 2.0.13, 2.1.13

Red Hat 16 advisories

  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 13 more Red Hat advisories
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:70277 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.8.GA com.fasterxml.jackson.core.jackson-core-2.18.9.redhat-00003.jar, com.fasterxml.jackson.core.jackson-databind-2.18.9.redhat-00003.jar, io.netty.netty-codec-4.1.136.Final-redhat-00001.jar +17
  • RHSA-2026:70257 Released 2026-09-22 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP2)
    • Red Hat Build of Apache Camel 3.33.3.SP2 com.github.luben.zstd-jni-1.5.7.16-rhel8-redhat-00001.jar, com.squareup.wire.wire-runtime-6.4.7.jar, com.squareup.wire.wire-runtime-jvm-6.4.7.jar +7
  • RHSA-2026:70230 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el10eap +47
  • RHSA-2026:70228 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el8eap +47
  • RHSA-2026:70229 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el9eap +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Legion of the Bouncy Castle BC-JAVA 1.85

    32 records Highest priority Priority MEDIUM 23 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer valuePriority MEDIUM 48
    • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-inPriority MEDIUM 48
    • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificatePriority MEDIUM 48
    Show all 32 records →
  • Release ·

    Legion of the Bouncy Castle BC-LTS-JAVA 2.73.12

    28 records Highest priority Priority MEDIUM 20 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer valuePriority MEDIUM 48
    • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-inPriority MEDIUM 48
    • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificatePriority MEDIUM 48
    Show all 28 records →
Show 1 more group
  • Release ·

    Legion of the Bouncy Castle BC-FJA 1.0.13, 2.0.13, 2.1.13

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-42535 OpenPGP CFB quick-check oracle active on symmetric/session-key pathsPriority MEDIUM 44
    • TI-2026-10955 OpenPGP AEAD decryption skips final tag on chunk-aligned dataPriority MEDIUM 43
    • TI-2026-42543 OpenPGP Argon2 S2K honours attacker-chosen memory and passesPriority LOW 31
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.3.SP2Fixed RHSA-2026:70257
Red Hat JBoss EAP 8.1 for RHEL 10Fixed RHSA-2026:70230
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:70228
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:70229
Red Hat JBoss Enterprise Application Platform 8.1.8.GAFixed RHSA-2026:70277
Not affected: 16 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat AMQ Clients
  • Red Hat Build of Apache Camel 3.33.3.SP2
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59649
  2. 2026-10-03 Alias added: GHSA-r7h8-35pv-fwgx
  3. 2026-10-09 Fix available: RHSA-2026:70257 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:70277 · Red Hat
  5. 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2, Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  6. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat
  7. 2026-10-16 Affected versions changed · Red Hat
  8. 2026-10-20 Affected versions changed · Red Hat
  9. 2026-10-21 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.8.GA · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  21. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
  22. 2026-11-03 Affected versions changed · Red Hat

References

Patch 2

  • TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
  • TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
  • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
  • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
  • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
  • TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences