cyfenced.com →

[ CVE-2026-59649 · Published 3 Aug 2026 ]

Vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA

CVSS 8.7 EPSS <1%3 agency advisoriesNo fix listed yet

[ Description ]Official description

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0448

    Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch

    Probability/damage H/HCVE-2026-54513CVE-2026-56741CVE-2026-59649+191 more CVEs
  • BSI CERT-BundWID-SEC-2026-4078

    Oracle Fusion Middleware: Multiple vulnerabilities Translated from German

    CVE-2026-91212CVE-2023-43622CVE-2026-42779+191 more CVEs
  • CERT-FRCERTFR-2026-AVI-1293

    Multiple vulnerabilities in MongoDB Translated from French

    Multiple vulnerabilities have been discovered in MongoDB products. They allow an attacker to cause remote denial of service and a security problem not specified by the vendor.

    CVE-2026-75595CVE-2026-59649CVE-2026-59648+30 more CVEs

[ References ]References