Bouncycastle Bcpg-Fips
5 CVEs affecting Bouncycastle Bcpg-Fips. Latest disclosed: 2026-08-03. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12817 | High | 8.6 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before… |
CVE-2026-59649 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java L… |
CVE-2026-59643 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA)… |
CVE-2026-59648 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before… |
CVE-2026-59640 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS… |