Skip to content
fr Sign in
8.7 High

CVE-2026-13506 In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard

Description

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected products and versions

Product Affected versions Fixed in
BC-JAVA 1.85 earliest → < 1.85 1.85
BC-LTS-JAVA 2.73 2.73.0 → < 2.73.12 2.73.12
BC-FJA 2.1 2.1.0 → < 2.1.3 2.1.3
BC-FJA 2.0 2.0.0 → < 2.0.2 2.0.2
BC-FJA 1.0 1.0.0 → < 1.0.2.7 1.0.2.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of BC-JAVA

The 52 CVEs of BC-JAVA →
CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,… 8.7 High CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every… 7.1 High CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)… 5.9 Medium CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509… 9.2 Critical
Track this CVE