FLAT-4AN54 – Vulnerability | Fluid Attacks Database

Database

Description

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 13	bouncycastle	=1.80-3
debian 14	bouncycastle	=1.80-3
debian 11	bouncycastle	=1.68-2 \|\| =1.68-3 \|\| =1.68-4 \|\| =1.68-5 \|\| =1.69-1 \|\| =1.71-1 \|\| =1.72-1 \|\| =1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3

Aliases

1. CVE-2026-596442. NVD-2026-596443. OSV-DEBIAN-2026-596444. OSV-2026-596445. SECURITY-TRACKER-CVE-2026-59644