Bouncycastle Bctls-Fips
3 CVEs affecting Bouncycastle Bctls-Fips. Latest disclosed: 2026-08-03. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14682 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Jav… |
CVE-2026-59646 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java… |
CVE-2026-59638 | Medium | 6.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle f… |