5.3
Moyenne
CVE-2026-58063 In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file
Description
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| BC-JAVA 1.85 | premières → < 1.85 | 1.85 |
| BC-LTS-JAVA 2.73 | 2.73.0 → < 2.73.12 | 2.73.12 |
| BC-FJA 2.1 | 2.1.0 → < 2.1.3 | 2.1.3 |
| BC-FJA 2.0 | 2.0.0 → < 2.0.2 | 2.0.2 |
| BC-FJA 1.0 | 1.0.0 → < 1.0.2.7 | 1.0.2.7 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de BC-JAVA
Les 52 CVE de BC-JAVA →
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,…
8.7
Élevée
CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every…
7.1
Élevée
CVE-2026-18040
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)…
5.9
Moyenne
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509…
9.2
Critique