Vulnerabilities of Legion of the Bouncy Castle Inc. BC-FJA
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-58062 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate | 9.3 Critical | Aug 3, 2026 |
| CVE-2026-59638 | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in | 9.3 Critical | Aug 3, 2026 |
| CVE-2026-8763 | In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI | 9.3 Critical | Aug 3, 2026 |