PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59649 Legion of the Bouncy Castle Inc. CVE debrief

The vulnerability in Bouncy Castle for Java before version 1.85 allows for OpenPGP user-attribute subpacket length to be bounded only by JVM max memory. This issue affects multiple versions of Bouncy Castle for Java, including LTS and FIPS versions. Organizations should review their inventory and apply updates to prevent potential attacks. The CVE record was published on 2026-08-03T01:16:45.120Z and has not been modified since then. This issue has a high CVSS score of 8.7, indicating a serious vulnerability that requires immediate attention.

Vendor
Legion of the Bouncy Castle Inc.
Product
BC-JAVA
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-03
Original CVE updated
2026-08-03
Advisory published
2026-08-03
Advisory updated
2026-08-03

Who should care

Organizations using Bouncy Castle for Java should review their inventory and apply updates to prevent potential attacks. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams. The vulnerability affects multiple versions of Bouncy Castle for Java, including LTS and FIPS versions.

Technical summary

The vulnerability in Bouncy Castle for Java before version 1.85 allows for OpenPGP user-attribute subpacket length to be bounded only by JVM max memory. This issue affects multiple versions of Bouncy Castle for Java, including LTS and FIPS versions. The vulnerability has a high CVSS score of 8.7, indicating a serious vulnerability that requires immediate attention. The technical impact of this vulnerability is significant, as it could allow attackers to exploit the affected systems.

Defensive priority

Organizations using Bouncy Castle for Java should review their inventory and apply updates to prevent potential attacks.

Recommended defensive actions

  • Review and update Bouncy Castle for Java to version 1.85 or later
  • Inventory checks for affected Bouncy Castle for Java versions
  • Apply compensating controls to limit exposure
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates a vulnerability in Bouncy Castle for Java before version 1.85, affecting OpenPGP user-attribute subpacket length. This issue also impacts Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS (BC-FJA) before specific versions. The evidence is limited, and defenders should verify the affected scope and apply updates accordingly. The CVE record provides official guidance on this vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T01:16:45.120Z and has not been modified since then.