logo

Database

Out-of-bounds read In bouncycastle

Description

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-128522. NVD-2026-128523. OSV-2026-128524. OSV-DEBIAN-2026-128525. GCVE-2026-128526. https://github.com/bcgit/bc-java/wiki/CVE-2026-128527. SECURITY-TRACKER-CVE-2026-12852

References

1. https://github.com/bcgit/bc-java/commit/a747038bb5bbd5e29fb2b7607ab38af1fd8d1790

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.