Bouncycastle Bcpkix-Fips
5 CVEs affecting Bouncycastle Bcpkix-Fips. Latest disclosed: 2026-08-03. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15055 | High | 8.2 | 2026-08-03 | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-12802 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS befo… |
CVE-2026-59642 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LT… |
CVE-2026-59639 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS b… |
CVE-2026-59647 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73… |