CRITICAL🇵🇱 Wersja polska

CVE-2026-58062

CVSS 9.3v4.0pub. 2026-08-03upd. 2026-09-02

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

  • Bouncycastle Bc Java

    APP
    Bouncycastle
    1.66 – 1.85 (excl.)

  • Bouncycastle Bouncy Castle For Java Lts

    APP
    Bouncycastle
    ≤ 2.73.11

  • Bouncycastle Fips Java Api

    APP
    Bouncycastle
    < 2.0.22.1.0 – 2.1.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-59650CRITICAL9.3PL ✓same product

Bouncy Castle Java: brak walidacji wartości peer w protokole MTI/A0 DH

CVE-2026-8763CRITICAL9.3PL ✓same product

Bouncy Castle dla Java — bypass Name Constraints przez trailing dot

CVE-2026-59638CRITICAL9.3PL ✓same product

Bouncy Castle Java: błędna weryfikacja hostname (CN-fallback) w JSSE

CVE-2018-1000613CRITICAL9.8PL ✓same product

Niebezpieczna refleksja przy deserializacji klucza XMSS w Bouncy Castle

CVE-2026-12802HIGH8.7PL ✓same product

Bouncy Castle dla Java — brak weryfikacji tag-length w CMS AuthEnvelopedData