CVE-2026-59649 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Organizations using Bouncy Castle for Java should review their inventory and apply updates to prevent potential attacks. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams. The vulnerability affects multiple versions of Bouncy Castle for Java, including LTS and FIPS versions.

Technical summary

The vulnerability in Bouncy Castle for Java before version 1.85 allows for OpenPGP user-attribute subpacket length to be bounded only by JVM max memory. This issue affects multiple versions of Bouncy Castle for Java, including LTS and FIPS versions. The vulnerability has a high CVSS score of 8.7, indicating a serious vulnerability that requires immediate attention. The technical impact of this vulnerability is significant, as it could allow attackers to exploit the affected systems.

Defensive priority

Organizations using Bouncy Castle for Java should review their inventory and apply updates to prevent potential attacks.

Recommended defensive actions

• Review and update Bouncy Castle for Java to version 1.85 or later
• Inventory checks for affected Bouncy Castle for Java versions
• Apply compensating controls to limit exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates a vulnerability in Bouncy Castle for Java before version 1.85, affecting OpenPGP user-attribute subpacket length. This issue also impacts Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS (BC-FJA) before specific versions. The evidence is limited, and defenders should verify the affected scope and apply updates accordingly. The CVE record provides official guidance on this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.