Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 11	bouncycastle	=1.68-2 \|\| =1.68-3 \|\| =1.68-4 \|\| =1.68-5 \|\| =1.69-1 \|\| =1.71-1 \|\| =1.72-1 \|\| =1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3
debian 14	bouncycastle	=1.80-3
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3
debian 13	bouncycastle	=1.80-3

Aliases

1. CVE-2026-596482. NVD-2026-596483. OSV-DEBIAN-2026-596484. OSV-2026-596485. SECURITY-TRACKER-CVE-2026-59648

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.