| CVE-2026-59647 |
In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count
|
6.9
Medium
|
Aug 3, 2026 |
| CVE-2026-59648 |
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes
|
6.9
Medium
|
Aug 3, 2026 |
| CVE-2026-59649 |
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory
|
8.7
High
|
Aug 3, 2026 |
| CVE-2026-8763 |
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-15055 |
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input
|
5.3
Medium
|
Aug 3, 2026 |
| CVE-2026-8149 |
A vulnerability in Legion of the Bouncy Castle Inc
|
5.1
Medium
|
May 8, 2026 |
| CVE-2025-8885 |
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc
|
6.3
Medium
|
Aug 12, 2025 |