Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.bouncycastle:bc-fips-debug	>=1.0.0 <1.0.2.7 \|\| >=2.0.0 <2.0.2 \|\| >=2.1.0 <2.1.3	1.0.2.7, 2.0.2, 2.1.3
maven	org.bouncycastle:bc-fips	>=1.0.0 <1.0.2.7 \|\| >=2.0.0 <2.0.2 \|\| >=2.1.0 <2.1.3	1.0.2.7, 2.0.2, 2.1.3
maven	org.bouncycastle:bcpkix-jdk14	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcpkix-jdk15to18	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcpkix-jdk18on	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcpkix-lts8on	>=2.73.0 <2.73.12	2.73.12
maven	org.bouncycastle:bcprov-jdk14	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-jdk15to18	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-jdk18on	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-lts8on	>=2.73.0 <2.73.12	2.73.12

1-10 of 13

Aliases

1. CVE-2026-135862. NVD-2026-135863. OSV-2026-135864. OSV-DEBIAN-2026-135865. GCVE-2026-135866. https://github.com/bcgit/bc-java/wiki/CVE-2026-135867. SECURITY-TRACKER-CVE-2026-13586

References

1. https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b962. https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.