| CVE-2026-58062 |
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-59638 |
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-59650 |
In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value
|
9.3
Critical
|
Aug 3, 2026 |
| CVE-2026-8763 |
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI
|
9.3
Critical
|
Aug 3, 2026 |