Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	bouncycastle	=1.80-3 \|\| >=0 <1.86-1	1.86-1
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3 \|\| =1.86-1	-
maven	org.bouncycastle:bcutil-fips	>=2.0.2 <2.0.7 \|\| >=2.1.4 <2.1.7	2.0.7, 2.1.7
maven	org.bouncycastle:bcutil-jdk15to18	>=1.70.0 <1.85.0	1.85.0
maven	org.bouncycastle:bcutil-jdk18on	>=1.71.0 <1.85.0	1.85.0
maven	org.bouncycastle:bcutil-lts8on	>=2.73.0 <2.73.12	2.73.12
rpm rhel9	jmc	-	-
debian 13	bouncycastle	=1.80-3 \|\| =1.86-1	-

Aliases

1. CVE-2026-596452. NVD-2026-596453. OSV-DEBIAN-2026-596454. OSV-2026-596455. GCVE-2026-596456. SECURITY-TRACKER-CVE-2026-596457. https://github.com/bcgit/bc-java/wiki/CVE-2026-59645

References

1. https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.