{"vulnerability": "cve-2026-59638", "sightings": [{"uuid": "400ad253-53ab-4fc1-b285-c905cb8e3d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-59638", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117028986804143783", "content": "CVE-2026-59638 (CRITICAL, CVSS 9.3) in BC-JAVA: Improper cert validation due to default CN-fallback can expose TLS connections to MITM. Affects <1.85, LTS <2.73.12. Patch status unknown \u2014 monitor vendor & consider disabling fallback. https://radar.offseq.com/threat/cve-2026-59638-cwe-297-improper-validation-of-certificate-with-host-mismatch-in-legion-of-the-bouncy-aa319f6f20b27a8a #OffSeq #CVE202659638 #infosec", "creation_timestamp": "2026-08-03T01:30:25.595860Z"}, {"uuid": "80dbaeaa-9086-48ff-a129-a78fb33d0a91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59638", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6jtixsxk2u", "content": "CVE-2026-59638\nBouncy Castle for Java versions before 1.85, 2.73.12, and certain FIPS versions allow an attacker to bypass hostname verification, potentially leading to man-in-the-middle attacks. This is a security concern\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-03T12:48:03.826233Z"}, {"uuid": "6775a096-7656-43d9-a24c-f4db7e2ebdf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59638", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7f44jsss2l", "content": "CVE-2026-59638 - bouncycastle\nBouncy Castle for Java versions before 1.85, LTS before 2.73.12, and FIPS versions before 1.0.24, 2.0.24, and 2.1.24 have a security problem. This means that some\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bouncycastle #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-03T20:56:03.734604Z"}]}