Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.bouncycastle:bc-fips-debug	>=1.0.0 <1.0.2.7 \|\| >=2.0.0 <2.0.2 \|\| >=2.1.0 <2.1.3	1.0.2.7, 2.0.2, 2.1.3
maven	org.bouncycastle:bc-fips	>=1.0.0 <1.0.2.7 \|\| >=2.0.0 <2.0.2 \|\| >=2.1.0 <2.1.3	1.0.2.7, 2.0.2, 2.1.3
maven	org.bouncycastle:bcprov-jdk14	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-jdk15to18	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-jdk18on	>=0 <1.85.0	1.85.0
maven	org.bouncycastle:bcprov-lts8on	>=2.73.0 <2.73.12	2.73.12
maven	org.bouncycastle:bctls-fips	>=1.0.0 <1.0.24	1.0.24
rpm rhel9	jmc	-	-
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3 \|\| =1.86-1	-
debian 13	bouncycastle	=1.80-3 \|\| =1.86-1	-

1-10 of 11

Aliases

1. CVE-2026-146822. NVD-2026-146823. OSV-2026-146824. OSV-DEBIAN-2026-146825. GCVE-2026-146826. https://github.com/bcgit/bc-java/wiki/CVE-2026-146827. SECURITY-TRACKER-CVE-2026-14682

References

1. https://github.com/bcgit/bc-java/commit/37094e504ef50cf9ce4e0fb9e5105d495ff5c2d2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.