Vulnerability-Lookup

SUSE-SU-2026:23150-1

Vulnerability from csaf_suse - Published: 2026-08-06 07:40 - Updated: 2026-09-16 20:12

Summary

Security update for bouncycastle

Severity

Critical

Notes

Title of the patch: Security update for bouncycastle

Description of the patch: This update for bouncycastle fixes the following issues: Update to 1.85. Security issues fixed: - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI (bsc#1272700). - CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check (bsc#1272701). - CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption (bsc#1272702). - CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (bsc#1272703). - CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split (bsc#1272704). - CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data (bsc#1272705). - CVE-2026-12852: MLS wire decoder allocates attacker-declared opaque length before bounds check (bsc#1272707). - CVE-2026-12860: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (bsc#1272708). - CVE-2026-13506: Lazy ASN.1 sequence forcing resets nesting-depth guard (bsc#1272709). - CVE-2026-13586: PKCS#12 MAC and bag-decryption KDF iteration-count bound (bsc#1272710). - CVE-2026-14682: Possible OOM from unbounded up-front allocation on a definite-length read (bsc#1272711). - CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (bsc#1272712). - CVE-2026-58059: Quadratic-time escaping when stringifying X.500 distinguished names (bsc#1272713). - CVE-2026-58060: HSS public-key level count unbounded, enabling huge allocation on verify (bsc#1272714). - CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check (bsc#1272715). - CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate (bsc#1272716). - CVE-2026-58063: BCFKS keystore load honours unbounded KDF cost from untrusted file (bsc#1272717). - CVE-2026-59638: JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (bsc#1272718). - CVE-2026-59639: CMS verifySignatures returns true for SignedData with zero signers (bsc#1272719). - CVE-2026-59640: OpenPGP CFB quick-check oracle active on symmetric/session-key paths (bsc#1272720). - CVE-2026-59641: S/MIME validator trusts signer-asserted signingTime for path validation (bsc#1272721). - CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present (bsc#1272722). - CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored (bsc#1272723). - CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (bsc#1272724). - CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (bsc#1272725). - CVE-2026-59646: DTLS handshake reassembler allocates buffer from unchecked 24-bit length (bsc#1272726). - CVE-2026-59647: CRMF/CMP password-MAC honours unbounded iteration count (bsc#1272727). - CVE-2026-59648: OpenPGP Argon2 S2K honours attacker-chosen memory and passes (bsc#1272728). - CVE-2026-59649: OpenPGP user-attribute subpacket length bounded only by JVM max memory (bsc#1272729). - CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value (bsc#1272730). - CVE-2026-59651: BKS keystore accepts legacy version with 16-bit integrity MAC key (bsc#1272731). - CVE-2026-59652: LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (bsc#1272732). Additional notes: - The standardised PQC algorithms ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, and CMCE have been repackaged under `org.bouncycastle.crypto` and the versions under `org.bouncycastle.crypto.pqc` have been deprecated. These deprecated versions will be removed in BC 1.86.

Patchnames: SUSE-SLES-16.0-1437

CVE-2026-12185

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-12802

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-12803

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-12816

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-12817

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-12852

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-12860

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-13506

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-13586

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-14682

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-15055

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-58059

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-58060

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-58061

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-58062

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact critical

CVE-2026-58063

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-59638

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact critical

CVE-2026-59639

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59640

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59641

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59642

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59643

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59644

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59645

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59646

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59647

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-59648

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-59649

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact important

CVE-2026-59650

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact critical

CVE-2026-59651

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-59652

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact moderate

CVE-2026-8763

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-12185

Threats

Impact critical

References

132 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1272700	self
https://bugzilla.suse.com/1272701	self
https://bugzilla.suse.com/1272702	self
https://bugzilla.suse.com/1272703	self
https://bugzilla.suse.com/1272704	self
https://bugzilla.suse.com/1272705	self
https://bugzilla.suse.com/1272707	self
https://bugzilla.suse.com/1272708	self
https://bugzilla.suse.com/1272709	self
https://bugzilla.suse.com/1272710	self
https://bugzilla.suse.com/1272711	self
https://bugzilla.suse.com/1272712	self
https://bugzilla.suse.com/1272713	self
https://bugzilla.suse.com/1272714	self
https://bugzilla.suse.com/1272715	self
https://bugzilla.suse.com/1272716	self
https://bugzilla.suse.com/1272717	self
https://bugzilla.suse.com/1272718	self
https://bugzilla.suse.com/1272719	self
https://bugzilla.suse.com/1272720	self
https://bugzilla.suse.com/1272721	self
https://bugzilla.suse.com/1272722	self
https://bugzilla.suse.com/1272723	self
https://bugzilla.suse.com/1272724	self
https://bugzilla.suse.com/1272725	self
https://bugzilla.suse.com/1272726	self
https://bugzilla.suse.com/1272727	self
https://bugzilla.suse.com/1272728	self
https://bugzilla.suse.com/1272729	self
https://bugzilla.suse.com/1272730	self
https://bugzilla.suse.com/1272731	self
https://bugzilla.suse.com/1272732	self
https://www.suse.com/security/cve/CVE-2026-12185/	self
https://www.suse.com/security/cve/CVE-2026-12802/	self
https://www.suse.com/security/cve/CVE-2026-12803/	self
https://www.suse.com/security/cve/CVE-2026-12816/	self
https://www.suse.com/security/cve/CVE-2026-12817/	self
https://www.suse.com/security/cve/CVE-2026-12852/	self
https://www.suse.com/security/cve/CVE-2026-12860/	self
https://www.suse.com/security/cve/CVE-2026-13506/	self
https://www.suse.com/security/cve/CVE-2026-13586/	self
https://www.suse.com/security/cve/CVE-2026-14682/	self
https://www.suse.com/security/cve/CVE-2026-15055/	self
https://www.suse.com/security/cve/CVE-2026-58059/	self
https://www.suse.com/security/cve/CVE-2026-58060/	self
https://www.suse.com/security/cve/CVE-2026-58061/	self
https://www.suse.com/security/cve/CVE-2026-58062/	self
https://www.suse.com/security/cve/CVE-2026-58063/	self
https://www.suse.com/security/cve/CVE-2026-59638/	self
https://www.suse.com/security/cve/CVE-2026-59639/	self
https://www.suse.com/security/cve/CVE-2026-59640/	self
https://www.suse.com/security/cve/CVE-2026-59641/	self
https://www.suse.com/security/cve/CVE-2026-59642/	self
https://www.suse.com/security/cve/CVE-2026-59643/	self
https://www.suse.com/security/cve/CVE-2026-59644/	self
https://www.suse.com/security/cve/CVE-2026-59645/	self
https://www.suse.com/security/cve/CVE-2026-59646/	self
https://www.suse.com/security/cve/CVE-2026-59647/	self
https://www.suse.com/security/cve/CVE-2026-59648/	self
https://www.suse.com/security/cve/CVE-2026-59649/	self
https://www.suse.com/security/cve/CVE-2026-59650/	self
https://www.suse.com/security/cve/CVE-2026-59651/	self
https://www.suse.com/security/cve/CVE-2026-59652/	self
https://www.suse.com/security/cve/CVE-2026-8763/	self
https://www.suse.com/security/cve/CVE-2026-12185	external
https://bugzilla.suse.com/1272701	external
https://www.suse.com/security/cve/CVE-2026-12802	external
https://bugzilla.suse.com/1272702	external
https://www.suse.com/security/cve/CVE-2026-12803	external
https://bugzilla.suse.com/1272703	external
https://www.suse.com/security/cve/CVE-2026-12816	external
https://bugzilla.suse.com/1272704	external
https://www.suse.com/security/cve/CVE-2026-12817	external
https://bugzilla.suse.com/1272705	external
https://www.suse.com/security/cve/CVE-2026-12852	external
https://bugzilla.suse.com/1272707	external
https://www.suse.com/security/cve/CVE-2026-12860	external
https://bugzilla.suse.com/1272708	external
https://www.suse.com/security/cve/CVE-2026-13506	external
https://bugzilla.suse.com/1272709	external
https://www.suse.com/security/cve/CVE-2026-13586	external
https://bugzilla.suse.com/1272710	external
https://www.suse.com/security/cve/CVE-2026-14682	external
https://bugzilla.suse.com/1272711	external
https://www.suse.com/security/cve/CVE-2026-15055	external
https://bugzilla.suse.com/1272712	external
https://www.suse.com/security/cve/CVE-2026-58059	external
https://bugzilla.suse.com/1272713	external
https://www.suse.com/security/cve/CVE-2026-58060	external
https://bugzilla.suse.com/1272714	external
https://www.suse.com/security/cve/CVE-2026-58061	external
https://bugzilla.suse.com/1272715	external
https://www.suse.com/security/cve/CVE-2026-58062	external
https://bugzilla.suse.com/1272716	external
https://www.suse.com/security/cve/CVE-2026-58063	external
https://bugzilla.suse.com/1272717	external
https://www.suse.com/security/cve/CVE-2026-59638	external
https://bugzilla.suse.com/1272718	external
https://www.suse.com/security/cve/CVE-2026-59639	external
https://bugzilla.suse.com/1272719	external
https://www.suse.com/security/cve/CVE-2026-59640	external
https://bugzilla.suse.com/1272720	external
https://www.suse.com/security/cve/CVE-2026-59641	external
https://bugzilla.suse.com/1272721	external
https://www.suse.com/security/cve/CVE-2026-59642	external
https://bugzilla.suse.com/1272722	external
https://www.suse.com/security/cve/CVE-2026-59643	external
https://bugzilla.suse.com/1272723	external
https://www.suse.com/security/cve/CVE-2026-59644	external
https://bugzilla.suse.com/1272724	external
https://www.suse.com/security/cve/CVE-2026-59645	external
https://bugzilla.suse.com/1272725	external
https://www.suse.com/security/cve/CVE-2026-59646	external
https://bugzilla.suse.com/1272726	external
https://www.suse.com/security/cve/CVE-2026-59647	external
https://bugzilla.suse.com/1272727	external
https://www.suse.com/security/cve/CVE-2026-59648	external
https://bugzilla.suse.com/1272728	external
https://www.suse.com/security/cve/CVE-2026-59649	external
https://bugzilla.suse.com/1272729	external
https://www.suse.com/security/cve/CVE-2026-59650	external
https://bugzilla.suse.com/1272730	external
https://www.suse.com/security/cve/CVE-2026-59651	external
https://bugzilla.suse.com/1272731	external
https://www.suse.com/security/cve/CVE-2026-59652	external
https://bugzilla.suse.com/1272732	external
https://www.suse.com/security/cve/CVE-2026-8763	external
https://bugzilla.suse.com/1272700	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for bouncycastle",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for bouncycastle fixes the following issues:\n\nUpdate to 1.85.\n\nSecurity issues fixed:\n\n- CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI (bsc#1272700).\n- CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check (bsc#1272701).\n- CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption (bsc#1272702).\n- CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (bsc#1272703).\n- CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split (bsc#1272704).\n- CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data (bsc#1272705).\n- CVE-2026-12852: MLS wire decoder allocates attacker-declared opaque length before bounds check (bsc#1272707).\n- CVE-2026-12860: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (bsc#1272708).\n- CVE-2026-13506: Lazy ASN.1 sequence forcing resets nesting-depth guard (bsc#1272709).\n- CVE-2026-13586: PKCS#12 MAC and bag-decryption KDF iteration-count bound (bsc#1272710).\n- CVE-2026-14682: Possible OOM from unbounded up-front allocation on a definite-length read (bsc#1272711).\n- CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (bsc#1272712).\n- CVE-2026-58059: Quadratic-time escaping when stringifying X.500 distinguished names (bsc#1272713).\n- CVE-2026-58060: HSS public-key level count unbounded, enabling huge allocation on verify (bsc#1272714).\n- CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check (bsc#1272715).\n- CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate (bsc#1272716).\n- CVE-2026-58063: BCFKS keystore load honours unbounded KDF cost from untrusted file (bsc#1272717).\n- CVE-2026-59638: JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (bsc#1272718).\n- CVE-2026-59639: CMS verifySignatures returns true for SignedData with zero signers (bsc#1272719).\n- CVE-2026-59640: OpenPGP CFB quick-check oracle active on symmetric/session-key paths (bsc#1272720).\n- CVE-2026-59641: S/MIME validator trusts signer-asserted signingTime for path validation (bsc#1272721).\n- CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present (bsc#1272722).\n- CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored (bsc#1272723).\n- CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (bsc#1272724).\n- CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (bsc#1272725).\n- CVE-2026-59646: DTLS handshake reassembler allocates buffer from unchecked 24-bit length (bsc#1272726).\n- CVE-2026-59647: CRMF/CMP password-MAC honours unbounded iteration count (bsc#1272727).\n- CVE-2026-59648: OpenPGP Argon2 S2K honours attacker-chosen memory and passes (bsc#1272728).\n- CVE-2026-59649: OpenPGP user-attribute subpacket length bounded only by JVM max memory (bsc#1272729).\n- CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value (bsc#1272730).\n- CVE-2026-59651: BKS keystore accepts legacy version with 16-bit integrity MAC key (bsc#1272731).\n- CVE-2026-59652: LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (bsc#1272732).\n\nAdditional notes:\n\n- The standardised PQC algorithms ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, and CMCE have been repackaged under\n  `org.bouncycastle.crypto` and the versions under `org.bouncycastle.crypto.pqc` have been deprecated. These deprecated\n  versions will be removed in BC 1.86.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1437",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23150-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:23150-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623150-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:23150-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049265.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272700",
        "url": "https://bugzilla.suse.com/1272700"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272701",
        "url": "https://bugzilla.suse.com/1272701"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272702",
        "url": "https://bugzilla.suse.com/1272702"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272703",
        "url": "https://bugzilla.suse.com/1272703"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272704",
        "url": "https://bugzilla.suse.com/1272704"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272705",
        "url": "https://bugzilla.suse.com/1272705"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272707",
        "url": "https://bugzilla.suse.com/1272707"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272708",
        "url": "https://bugzilla.suse.com/1272708"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272709",
        "url": "https://bugzilla.suse.com/1272709"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272710",
        "url": "https://bugzilla.suse.com/1272710"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272711",
        "url": "https://bugzilla.suse.com/1272711"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272712",
        "url": "https://bugzilla.suse.com/1272712"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272713",
        "url": "https://bugzilla.suse.com/1272713"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272714",
        "url": "https://bugzilla.suse.com/1272714"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272715",
        "url": "https://bugzilla.suse.com/1272715"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272716",
        "url": "https://bugzilla.suse.com/1272716"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272717",
        "url": "https://bugzilla.suse.com/1272717"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272718",
        "url": "https://bugzilla.suse.com/1272718"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272719",
        "url": "https://bugzilla.suse.com/1272719"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272720",
        "url": "https://bugzilla.suse.com/1272720"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272721",
        "url": "https://bugzilla.suse.com/1272721"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272722",
        "url": "https://bugzilla.suse.com/1272722"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272723",
        "url": "https://bugzilla.suse.com/1272723"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272724",
        "url": "https://bugzilla.suse.com/1272724"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272725",
        "url": "https://bugzilla.suse.com/1272725"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272726",
        "url": "https://bugzilla.suse.com/1272726"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272727",
        "url": "https://bugzilla.suse.com/1272727"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272728",
        "url": "https://bugzilla.suse.com/1272728"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272729",
        "url": "https://bugzilla.suse.com/1272729"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272730",
        "url": "https://bugzilla.suse.com/1272730"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272731",
        "url": "https://bugzilla.suse.com/1272731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272732",
        "url": "https://bugzilla.suse.com/1272732"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12185 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12185/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12802 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12802/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12803 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12803/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12816 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12816/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12817 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12817/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12852 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12852/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-12860 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-12860/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-13506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-13506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-13586 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-13586/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-14682 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-14682/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-15055 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-15055/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-58059 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-58059/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-58060 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-58060/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-58061 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-58061/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-58062 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-58062/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-58063 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-58063/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59638 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59638/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59639 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59639/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59640 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59640/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59641 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59641/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59642 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59642/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59643 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59643/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59644 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59644/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59645 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59645/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59646 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59646/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59647 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59647/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59648 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59648/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59649 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59649/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59650 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59650/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59651 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59651/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59652 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59652/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-8763 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-8763/"
      }
    ],
    "title": "Security update for bouncycastle",
    "tracking": {
      "current_release_date": "2026-09-16T20:12:02Z",
      "generator": {
        "date": "2026-08-06T07:40:53Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:23150-1",
      "initial_release_date": "2026-08-06T07:40:53Z",
      "revision_history": [
        {
          "date": "2026-08-06T07:40:53Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:24:08Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:12:02Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bouncycastle-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-javadoc-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-javadoc-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-javadoc-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-javadoc@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-jmail-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-jmail-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-jmail-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-jmail@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-mail-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-mail-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-mail-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-mail@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-pg-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-pg-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-pg-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-pg@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-pkix-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-pkix-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-pkix-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-pkix@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-tls-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-tls-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-tls-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-tls@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bouncycastle-util-1.85-160000.1.1.noarch",
                "product": {
                  "name": "bouncycastle-util-1.85-160000.1.1.noarch",
                  "product_id": "bouncycastle-util-1.85-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.85:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bouncycastle-util@1.85-160000.1.1?arch=noarch\u0026upstream=bouncycastle-1.85-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-javadoc-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-javadoc-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-jmail-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-jmail-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-mail-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-mail-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-pg-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-pg-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-pkix-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-pkix-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-tls-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-tls-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-util-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-util-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-javadoc-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-javadoc-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-jmail-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-jmail-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-mail-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-mail-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-pg-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-pg-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-pkix-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-pkix-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-tls-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-tls-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bouncycastle-util-1.85-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        },
        "product_reference": "bouncycastle-util-1.85-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12185",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12185"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12185",
          "url": "https://www.suse.com/security/cve/CVE-2026-12185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272701 for CVE-2026-12185",
          "url": "https://bugzilla.suse.com/1272701"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-12185"
    },
    {
      "cve": "CVE-2026-12802",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12802"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12802",
          "url": "https://www.suse.com/security/cve/CVE-2026-12802"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272702 for CVE-2026-12802",
          "url": "https://bugzilla.suse.com/1272702"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12802"
    },
    {
      "cve": "CVE-2026-12803",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12803"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12803",
          "url": "https://www.suse.com/security/cve/CVE-2026-12803"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272703 for CVE-2026-12803",
          "url": "https://bugzilla.suse.com/1272703"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12803"
    },
    {
      "cve": "CVE-2026-12816",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12816"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12816",
          "url": "https://www.suse.com/security/cve/CVE-2026-12816"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272704 for CVE-2026-12816",
          "url": "https://bugzilla.suse.com/1272704"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12816"
    },
    {
      "cve": "CVE-2026-12817",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12817"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12817",
          "url": "https://www.suse.com/security/cve/CVE-2026-12817"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272705 for CVE-2026-12817",
          "url": "https://bugzilla.suse.com/1272705"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12817"
    },
    {
      "cve": "CVE-2026-12852",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12852"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12852",
          "url": "https://www.suse.com/security/cve/CVE-2026-12852"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272707 for CVE-2026-12852",
          "url": "https://bugzilla.suse.com/1272707"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12852"
    },
    {
      "cve": "CVE-2026-12860",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-12860"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-12860",
          "url": "https://www.suse.com/security/cve/CVE-2026-12860"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272708 for CVE-2026-12860",
          "url": "https://bugzilla.suse.com/1272708"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-12860"
    },
    {
      "cve": "CVE-2026-13506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-13506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-13506",
          "url": "https://www.suse.com/security/cve/CVE-2026-13506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272709 for CVE-2026-13506",
          "url": "https://bugzilla.suse.com/1272709"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-13506"
    },
    {
      "cve": "CVE-2026-13586",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-13586"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-13586",
          "url": "https://www.suse.com/security/cve/CVE-2026-13586"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272710 for CVE-2026-13586",
          "url": "https://bugzilla.suse.com/1272710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-13586"
    },
    {
      "cve": "CVE-2026-14682",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-14682"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-14682",
          "url": "https://www.suse.com/security/cve/CVE-2026-14682"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272711 for CVE-2026-14682",
          "url": "https://bugzilla.suse.com/1272711"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-14682"
    },
    {
      "cve": "CVE-2026-15055",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-15055"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-15055",
          "url": "https://www.suse.com/security/cve/CVE-2026-15055"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272712 for CVE-2026-15055",
          "url": "https://bugzilla.suse.com/1272712"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-15055"
    },
    {
      "cve": "CVE-2026-58059",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-58059"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-58059",
          "url": "https://www.suse.com/security/cve/CVE-2026-58059"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272713 for CVE-2026-58059",
          "url": "https://bugzilla.suse.com/1272713"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-58059"
    },
    {
      "cve": "CVE-2026-58060",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-58060"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-58060",
          "url": "https://www.suse.com/security/cve/CVE-2026-58060"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272714 for CVE-2026-58060",
          "url": "https://bugzilla.suse.com/1272714"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-58060"
    },
    {
      "cve": "CVE-2026-58061",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-58061"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-58061",
          "url": "https://www.suse.com/security/cve/CVE-2026-58061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272715 for CVE-2026-58061",
          "url": "https://bugzilla.suse.com/1272715"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-58061"
    },
    {
      "cve": "CVE-2026-58062",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-58062"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-58062",
          "url": "https://www.suse.com/security/cve/CVE-2026-58062"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272716 for CVE-2026-58062",
          "url": "https://bugzilla.suse.com/1272716"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-58062"
    },
    {
      "cve": "CVE-2026-58063",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-58063"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-58063",
          "url": "https://www.suse.com/security/cve/CVE-2026-58063"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272717 for CVE-2026-58063",
          "url": "https://bugzilla.suse.com/1272717"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-58063"
    },
    {
      "cve": "CVE-2026-59638",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59638"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59638",
          "url": "https://www.suse.com/security/cve/CVE-2026-59638"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272718 for CVE-2026-59638",
          "url": "https://bugzilla.suse.com/1272718"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-59638"
    },
    {
      "cve": "CVE-2026-59639",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59639"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59639",
          "url": "https://www.suse.com/security/cve/CVE-2026-59639"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272719 for CVE-2026-59639",
          "url": "https://bugzilla.suse.com/1272719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59639"
    },
    {
      "cve": "CVE-2026-59640",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59640"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59640",
          "url": "https://www.suse.com/security/cve/CVE-2026-59640"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272720 for CVE-2026-59640",
          "url": "https://bugzilla.suse.com/1272720"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59640"
    },
    {
      "cve": "CVE-2026-59641",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59641"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59641",
          "url": "https://www.suse.com/security/cve/CVE-2026-59641"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272721 for CVE-2026-59641",
          "url": "https://bugzilla.suse.com/1272721"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59641"
    },
    {
      "cve": "CVE-2026-59642",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59642"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59642",
          "url": "https://www.suse.com/security/cve/CVE-2026-59642"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272722 for CVE-2026-59642",
          "url": "https://bugzilla.suse.com/1272722"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59642"
    },
    {
      "cve": "CVE-2026-59643",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59643"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59643",
          "url": "https://www.suse.com/security/cve/CVE-2026-59643"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272723 for CVE-2026-59643",
          "url": "https://bugzilla.suse.com/1272723"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59643"
    },
    {
      "cve": "CVE-2026-59644",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59644"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59644",
          "url": "https://www.suse.com/security/cve/CVE-2026-59644"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272724 for CVE-2026-59644",
          "url": "https://bugzilla.suse.com/1272724"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59644"
    },
    {
      "cve": "CVE-2026-59645",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59645"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59645",
          "url": "https://www.suse.com/security/cve/CVE-2026-59645"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272725 for CVE-2026-59645",
          "url": "https://bugzilla.suse.com/1272725"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59645"
    },
    {
      "cve": "CVE-2026-59646",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59646"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59646",
          "url": "https://www.suse.com/security/cve/CVE-2026-59646"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272726 for CVE-2026-59646",
          "url": "https://bugzilla.suse.com/1272726"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59646"
    },
    {
      "cve": "CVE-2026-59647",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59647"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59647",
          "url": "https://www.suse.com/security/cve/CVE-2026-59647"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272727 for CVE-2026-59647",
          "url": "https://bugzilla.suse.com/1272727"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59647"
    },
    {
      "cve": "CVE-2026-59648",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59648"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59648",
          "url": "https://www.suse.com/security/cve/CVE-2026-59648"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272728 for CVE-2026-59648",
          "url": "https://bugzilla.suse.com/1272728"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59648"
    },
    {
      "cve": "CVE-2026-59649",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59649"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59649",
          "url": "https://www.suse.com/security/cve/CVE-2026-59649"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272729 for CVE-2026-59649",
          "url": "https://bugzilla.suse.com/1272729"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59649"
    },
    {
      "cve": "CVE-2026-59650",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59650"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59650",
          "url": "https://www.suse.com/security/cve/CVE-2026-59650"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272730 for CVE-2026-59650",
          "url": "https://bugzilla.suse.com/1272730"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-59650"
    },
    {
      "cve": "CVE-2026-59651",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59651"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59651",
          "url": "https://www.suse.com/security/cve/CVE-2026-59651"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272731 for CVE-2026-59651",
          "url": "https://bugzilla.suse.com/1272731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59651"
    },
    {
      "cve": "CVE-2026-59652",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59652"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59652",
          "url": "https://www.suse.com/security/cve/CVE-2026-59652"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272732 for CVE-2026-59652",
          "url": "https://bugzilla.suse.com/1272732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59652"
    },
    {
      "cve": "CVE-2026-8763",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-8763"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-8763",
          "url": "https://www.suse.com/security/cve/CVE-2026-8763"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272700 for CVE-2026-8763",
          "url": "https://bugzilla.suse.com/1272700"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.85-160000.1.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.85-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T07:40:53Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-8763"
    }
  ]
}

CVE-2026-12185 (GCVE-0-2026-12185)

Vulnerability from cvelistv5 – Published: 2026-08-03 00:38 – Updated: 2026-08-04 01:54

Title

BKS/UBER keystore allocates from untrusted lengths before integrity check

Summary

In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 13:29 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/7bbd7fe5f…	patch

Impacted products

2 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research Wayde Shi (GitHub: @waydeshi )

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T13:29:56.930597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T13:30:08.548Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "prov"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "BcKeyStoreSpi"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "prov"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "BcKeyStoreSpi"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wayde Shi (GitHub: @waydeshi )"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T01:54:27.357Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012185"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/7bbd7fe5f44132e5b6140a2914435c12430eeb3d"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BKS/UBER keystore allocates from untrusted lengths before integrity check",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12185",
    "datePublished": "2026-08-03T00:38:01.609Z",
    "dateReserved": "2026-06-14T00:39:34.400Z",
    "dateUpdated": "2026-08-04T01:54:27.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12802 (GCVE-0-2026-12802)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:48 – Updated: 2026-08-03 15:28

Title

CMS AuthEnvelopedData fails to enforce tag-length on decryption

Summary

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:27 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/0fefa539e…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.12 (maven) Affected: 2.0.0 , < 2.0.12 (maven) Affected: 2.1.0 , < 2.1.12 (maven)

Credits

Thai Duong

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:27:40.666430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:28:12.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "AbstractRecipient"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "pkix"
          ],
          "packageName": "bcpkix-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "AbstractRecipient"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bcpkix-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.12",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.12",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.12",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Thai Duong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:59:51.721Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012802"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/0fefa539e6ac5c66e1daee5a13b23d1d4769cc01"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CMS AuthEnvelopedData fails to enforce tag-length on decryption",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12802",
    "datePublished": "2026-08-03T02:48:42.672Z",
    "dateReserved": "2026-06-20T23:07:20.197Z",
    "dateUpdated": "2026-08-03T15:28:12.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12803 (GCVE-0-2026-12803)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:52 – Updated: 2026-08-03 15:22

Title

KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

Summary

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:22 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg mitre root

References

3 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/697794413…	patch
https://github.com/bcgit/bc-java/commit/7d79aa76e…	patch

Impacted products

2 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:22:13.635738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:22:55.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "KCCMBlockCipher"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "KCCMBlockCipher"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:58:49.795Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012803"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/697794413ebf7bc5e3fce609a707826ba52981af"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/7d79aa76e984da85f2a541cae8ba2ae56e1713bc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12803",
    "datePublished": "2026-08-03T02:52:20.460Z",
    "dateReserved": "2026-06-21T01:50:45.847Z",
    "dateUpdated": "2026-08-03T15:22:55.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12816 (GCVE-0-2026-12816)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:53 – Updated: 2026-08-03 15:21

Title

IESEngine stream-mode MAC forgery via length-dependent KDF split

Summary

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:20 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/6d9e4bbae…	patch

Impacted products

2 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:20:07.709457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:21:22.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "IESEngine"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "IESEngine"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:58:13.037Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012816"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/6d9e4bbaee9409713ada167e5f901554cbb084ac"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IESEngine stream-mode MAC forgery via length-dependent KDF split",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12816",
    "datePublished": "2026-08-03T02:53:32.240Z",
    "dateReserved": "2026-06-21T08:41:26.174Z",
    "dateUpdated": "2026-08-03T15:21:22.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12817 (GCVE-0-2026-12817)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:54 – Updated: 2026-08-03 15:15

Title

OpenPGP AEAD decryption skips final tag on chunk-aligned data

Summary

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:14 UTC

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/4b7128198…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 1.74 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.7 , < 1.0.13 (maven) Affected: 2.0.0 , < 2.0.13 (maven) Affected: 2.1.0 , < 2.1.13 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:14:52.626308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:15:27.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "pg"
          ],
          "packageName": "bcpg",
          "packageURL": "pkg:maven/org.bouncycastle/bcpg-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "BcAEADUtil",
            "JceAEADUtil"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "1.74",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "pg"
          ],
          "packageName": "bcpg-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcpg-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "BcAEADUtil",
            "JceAEADUtil"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bcpg-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bcpg-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.13",
              "status": "affected",
              "version": "1.0.7",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.13",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.13",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354 Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:57:33.979Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012817"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/4b712819846ec944379f4909101abac20f0ad4b0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OpenPGP AEAD decryption skips final tag on chunk-aligned data",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12817",
    "datePublished": "2026-08-03T02:54:16.880Z",
    "dateReserved": "2026-06-21T08:58:04.722Z",
    "dateUpdated": "2026-08-03T15:15:27.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12852 (GCVE-0-2026-12852)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:55 – Updated: 2026-08-03 15:11

Title

MLS wire decoder allocates attacker-declared opaque length before bounds check

Summary

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:11 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/a747038bb…	patch

Impacted products

1 product

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 1.73 , < 1.85 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:11:15.405624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:11:39.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "mls"
          ],
          "packageName": "bcmls",
          "packageURL": "pkg:maven/org.bouncycastle/bcmls-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "MLSInputStream"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "1.73",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:56:59.481Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012852"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/a747038bb5bbd5e29fb2b7607ab38af1fd8d1790"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MLS wire decoder allocates attacker-declared opaque length before bounds check",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12852",
    "datePublished": "2026-08-03T02:55:02.485Z",
    "dateReserved": "2026-06-22T03:41:00.916Z",
    "dateUpdated": "2026-08-03T15:11:39.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12860 (GCVE-0-2026-12860)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:55 – Updated: 2026-08-03 15:10

Title

RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

Summary

In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:09 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/ea5970ea9…	patch

Impacted products

2 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)

Credits

Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:09:44.027855Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:10:17.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "RSADigestSigner"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "RSADigestSigner"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:56:08.202Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012860"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/ea5970ea9b2fb91d763b904692fd21089ca3e396"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-12860",
    "datePublished": "2026-08-03T02:55:58.379Z",
    "dateReserved": "2026-06-22T07:51:11.945Z",
    "dateUpdated": "2026-08-03T15:10:17.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13506 (GCVE-0-2026-13506)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:56 – Updated: 2026-08-03 15:09

Title

Lazy ASN.1 sequence forcing resets nesting-depth guard

Summary

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:08 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE-2026-13506	vendor-advisory
https://github.com/bcgit/bc-java/commit/77454da9b…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.2.7 (maven) Affected: 2.0.0 , < 2.0.2 (maven) Affected: 2.1.0 , < 2.1.3 (maven)

Credits

Yt Alex Gaynor in collaboration with Claude and Anthropic Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:08:42.725883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:09:01.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "LazyEncodedSequence",
            "ASN1InputStream"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "LazyEncodedSequence",
            "ASN1InputStream"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bc-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.2.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.3",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yt"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor in collaboration with Claude and Anthropic Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T02:56:49.476Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lazy ASN.1 sequence forcing resets nesting-depth guard",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-13506",
    "datePublished": "2026-08-03T02:56:49.476Z",
    "dateReserved": "2026-06-28T04:39:00.599Z",
    "dateUpdated": "2026-08-03T15:09:01.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13586 (GCVE-0-2026-13586)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:58 – Updated: 2026-08-03 15:03

Title

PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)

Summary

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:03 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

bcorg mitre root

References

3 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/fa59cc235…	patch
https://github.com/bcgit/bc-java/commit/75d60dfb4…	patch

Impacted products

3 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.2.7 (maven) Affected: 2.0.0 , < 2.0.2 (maven) Affected: 2.1.0 , < 2.1.3 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:03:33.340510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:03:49.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "prov"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "PKCS12KeyStoreSpi",
            "PKCS12PBMAC1KeyStoreSpi",
            "PKCS12Util"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "prov"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "PKCS12KeyStoreSpi",
            "PKCS12PBMAC1KeyStoreSpi",
            "PKCS12Util"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bc-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.2.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.3",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T05:55:23.786Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013586"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-13586",
    "datePublished": "2026-08-03T02:58:00.982Z",
    "dateReserved": "2026-06-29T04:09:24.833Z",
    "dateUpdated": "2026-08-03T15:03:49.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14682 (GCVE-0-2026-14682)

Vulnerability from cvelistv5 – Published: 2026-08-03 02:44 – Updated: 2026-08-04 09:24

Title

Possible OOM from unbounded up-front allocation on a definite-length read

Summary

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 15:31 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

bcorg mitre root

References

2 references

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	vendor-advisory
https://github.com/bcgit/bc-java/commit/37094e504…	patch

Impacted products

4 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC-JAVA	Affected: 0 , < 1.85 (maven)
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	Affected: 2.73.0 , < 2.73.12 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.2.7 (maven) Affected: 2.0.0 , < 2.0.2 (maven) Affected: 2.1.0 , < 2.1.3 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , < 1.0.24 (maven)

Credits

Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. Yt

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T15:31:04.802553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T15:31:31.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
          "platforms": [
            "all"
          ],
          "product": "BC-JAVA",
          "programFiles": [
            "DefiniteLengthInputStream"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.85",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "packageName": "bcprov-lts8on",
          "packageURL": "pkg:maven/org.bouncycastle/bcprov-lts8on",
          "platforms": [
            "all"
          ],
          "product": "BC-LTS-JAVA",
          "programFiles": [
            "DefiniteLengthInputStream"
          ],
          "repo": "https://github.com/bcgit/bc-lts-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "2.73.12",
              "status": "affected",
              "version": "2.73.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bc-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.2.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.0.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.1.3",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "defaultStatus": "unaffected",
          "packageName": "bctls-fips",
          "packageURL": "pkg:maven/org.bouncycastle/bctls-fips",
          "platforms": [
            "all"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThan": "1.0.24",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Micha\u0142 Majchrowicz and Marcin Wyczechowski, members of the AFINE Team."
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Yt"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.\u003c/p\u003e"
            }
          ],
          "value": "In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T09:24:50.033Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9014682"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bcgit/bc-java/commit/37094e504ef50cf9ce4e0fb9e5105d495ff5c2d2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Possible OOM from unbounded up-front allocation on a definite-length read",
      "x_generator": {
        "engine": "bc release-notes template"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2026-14682",
    "datePublished": "2026-08-03T02:44:13.256Z",
    "dateReserved": "2026-07-04T00:33:39.368Z",
    "dateUpdated": "2026-08-04T09:24:50.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:23150-1

CVE-2026-12185 (GCVE-0-2026-12185)

CVE-2026-12802 (GCVE-0-2026-12802)

CVE-2026-12803 (GCVE-0-2026-12803)

CVE-2026-12816 (GCVE-0-2026-12816)

CVE-2026-12817 (GCVE-0-2026-12817)

CVE-2026-12852 (GCVE-0-2026-12852)

CVE-2026-12860 (GCVE-0-2026-12860)

CVE-2026-13506 (GCVE-0-2026-13506)

CVE-2026-13586 (GCVE-0-2026-13586)

CVE-2026-14682 (GCVE-0-2026-14682)

Tags

Sightings

Nomenclature

Related by attack behaviour