8.7
Élevée
CVE-2026-59643 In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored
Description
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.
Produits et versions touchés
Autres CVE de BC-JAVA
Les 52 CVE de BC-JAVA →
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,…
8.7
Élevée
CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every…
7.1
Élevée
CVE-2026-18040
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)…
5.9
Moyenne
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509…
9.2
Critique