Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	bouncycastle	=1.80-3 \|\| >=0 <1.86-1	1.86-1
maven	org.bouncycastle:bc-fips-debug	>=2.0.0 <2.0.2 \|\| >=2.1.0 <2.1.3	2.0.2, 2.1.3
maven	org.bouncycastle:bc-fips	>=2.0.0 <2.0.2 \|\| >=2.1.0 <2.1.3	2.0.2, 2.1.3
maven	org.bouncycastle:bcprov-jdk15to18	>=1.65.0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-jdk18on	>=1.71.0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-lts8on	>=2.73.0 <2.73.12	2.73.12
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3 \|\| =1.86-1	-
debian 13	bouncycastle	=1.80-3 \|\| =1.86-1	-

Aliases

1. CVE-2026-580602. NVD-2026-580603. OSV-DEBIAN-2026-580604. OSV-2026-580605. GCVE-2026-580606. SECURITY-TRACKER-CVE-2026-580607. https://github.com/bcgit/bc-java/wiki/CVE-2026-58060

References

1. https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a44391182762. https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.