| CVE-2026-71885 |
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509…
|
9.2
Critical
|
Oct 3, 2026 |
| CVE-2026-58062 |
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-59638 |
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-59650 |
In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-8763 |
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2025-14813 |
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
|
9.3
Critical
|
Apr 15, 2026 |