Hi,

The following vulnerabilities were published for bouncycastle.

CVE-2026-12185[0]:
| In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates
| from untrusted lengths before integrity check. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12.


CVE-2026-12802[1]:
| In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails
| to enforce tag-length on decryption. This issue also affects Bouncy
| Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS
| (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X
| series) and 2.1.12 (2.1.X series).


CVE-2026-12803[2]:
| In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not
| bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue
| also affects Bouncy Castle for Java LTS before 2.73.12.


CVE-2026-12816[3]:
| In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC
| forgery via length-dependent KDF split. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12.


CVE-2026-12817[4]:
| In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips
| final tag on chunk-aligned data. This issue also affects Bouncy
| Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS
| (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X
| series) and 2.1.13 (2.1.X series).


CVE-2026-12852[5]:
| In Bouncy Castle for Java before 1.85, MLS wire decoder allocates
| attacker-declared opaque length before bounds check.


CVE-2026-12860[6]:
| In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips
| last two hash bytes in NULL-omitted path. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12.


CVE-2026-13506[7]:
| In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing
| resets nesting-depth guard. This issue also affects Bouncy Castle
| for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-
| FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and
| 2.1.3 (2.1.X series).


CVE-2026-13586[8]:
| In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-
| decryption KDF iteration-count bound (DoS). This issue also affects
| Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for
| Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
| (2.0.X series) and 2.1.3 (2.1.X series).


CVE-2026-14682[9]:
| In Bouncy Castle for Java before 1.85, Possible OOM from unbounded
| up-front allocation on a definite-length read. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
| (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips
| 1.0.24.


CVE-2026-15055[10]:
| In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors
| honour unbounded KDF cost from input. This issue also affects Bouncy
| Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS
| (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X
| series) and 2.1.12 (2.1.X series).


CVE-2026-58059[11]:
| In Bouncy Castle for Java before 1.85, Quadratic-time escaping when
| stringifying X.500 distinguished names. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for
| Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
| (2.0.X series) and 2.1.3 (2.1.X series).


CVE-2026-58060[12]:
| In Bouncy Castle for Java before 1.85, HSS public-key level count
| unbounded, enabling huge allocation on verify. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3
| (2.1.X series).


CVE-2026-58061[13]:
| In Bouncy Castle for Java before 1.85, CCM-family modes write
| plaintext to caller buffer before tag check. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for
| Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
| (2.0.X series) and 2.1.3 (2.1.X series).


CVE-2026-58062[14]:
| In Bouncy Castle for Java before 1.85, Stapled OCSP response
| accepted without binding to the checked certificate. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3
| (2.1.X series).


CVE-2026-58063[15]:
| In Bouncy Castle for Java before 1.85, BCFKS keystore load honours
| unbounded KDF cost from untrusted file. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for
| Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
| (2.0.X series) and 2.1.3 (2.1.X series).


CVE-2026-59638[16]:
| In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-
| fallback enabled by default despite documented opt-in. This issue
| also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy
| Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X
| series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).


CVE-2026-59639[17]:
| In Bouncy Castle for Java before 1.85, CMS verifySignatures returns
| true for SignedData with zero signers. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for
| Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12
| (2.0.X series) and 2.1.12 (2.1.X series).


CVE-2026-59640[18]:
| In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check
| oracle active on symmetric/session-key paths. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series),
| 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).


CVE-2026-59641[19]:
| In Bouncy Castle for Java before 1.85, S/MIME validator trusts
| signer-asserted signingTime for path validation. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7
| (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).


CVE-2026-59642[20]:
| In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content
| not bound to MAC when authAttrs present. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for
| Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12
| (2.0.X series) and 2.1.12 (2.1.X series).


CVE-2026-59643[21]:
| In Bouncy Castle for Java before 1.85, OpenPGP inline-signature
| policy failures silently ignored. This issue also affects Bouncy
| Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.


CVE-2026-59644[22]:
| In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours
| arbitrary 32-bit generation counter from sender.


CVE-2026-59645[23]:
| In Bouncy Castle for Java before 1.85, OER parser recurses without
| depth limit on self-referential IEEE 1609.2 schema. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and
| 2.1.7 (2.1.X series).


CVE-2026-59646[24]:
| In Bouncy Castle for Java before 1.85, DTLS handshake reassembler
| allocates buffer from unchecked 24-bit length. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series),
| 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).


CVE-2026-59647[25]:
| In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours
| unbounded iteration count. This issue also affects Bouncy Castle for
| Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA)
| before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and
| 2.1.12 (2.1.X series).


CVE-2026-59648[26]:
| In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours
| attacker-chosen memory and passes. This issue also affects Bouncy
| Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS
| (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X
| series) and 2.1.13 (2.1.X series).


CVE-2026-59649[27]:
| In Bouncy Castle for Java before 1.85, OpenPGP user-attribute
| subpacket length bounded only by JVM max memory. This issue also
| affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle
| for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series),
| 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).


CVE-2026-59650[28]:
| In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement
| exponentiates unvalidated peer value. This issue also affects Bouncy
| Castle for Java LTS before 2.73.12.


CVE-2026-59651[29]:
| In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy
| version with 16-bit integrity MAC key. This issue also affects
| Bouncy Castle for Java LTS before 2.73.12.


CVE-2026-59652[30]:
| In Bouncy Castle for Java before 1.85, LDAP filter injection in
| legacy jdk1.4 LDAPStoreHelper.


CVE-2026-8763[31]:
| In Bouncy Castle for Java before 1.85, Name Constraints bypass via
| trailing dot in rfc822Name and URI. This issue also affects Bouncy
| Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS
| (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series)
| and 2.1.3 (2.1.X series).

All of those are fixed in upstream r1rv85.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-12185
https://www.cve.org/CVERecord?id=CVE-2026-12185
[1] https://security-tracker.debian.org/tracker/CVE-2026-12802
https://www.cve.org/CVERecord?id=CVE-2026-12802
[2] https://security-tracker.debian.org/tracker/CVE-2026-12803
https://www.cve.org/CVERecord?id=CVE-2026-12803
[3] https://security-tracker.debian.org/tracker/CVE-2026-12816
https://www.cve.org/CVERecord?id=CVE-2026-12816
[4] https://security-tracker.debian.org/tracker/CVE-2026-12817
https://www.cve.org/CVERecord?id=CVE-2026-12817
[5] https://security-tracker.debian.org/tracker/CVE-2026-12852
https://www.cve.org/CVERecord?id=CVE-2026-12852
[6] https://security-tracker.debian.org/tracker/CVE-2026-12860
https://www.cve.org/CVERecord?id=CVE-2026-12860
[7] https://security-tracker.debian.org/tracker/CVE-2026-13506
https://www.cve.org/CVERecord?id=CVE-2026-13506
[8] https://security-tracker.debian.org/tracker/CVE-2026-13586
https://www.cve.org/CVERecord?id=CVE-2026-13586
[9] https://security-tracker.debian.org/tracker/CVE-2026-14682
https://www.cve.org/CVERecord?id=CVE-2026-14682
[10] https://security-tracker.debian.org/tracker/CVE-2026-15055
https://www.cve.org/CVERecord?id=CVE-2026-15055
[11] https://security-tracker.debian.org/tracker/CVE-2026-58059
https://www.cve.org/CVERecord?id=CVE-2026-58059
[12] https://security-tracker.debian.org/tracker/CVE-2026-58060
https://www.cve.org/CVERecord?id=CVE-2026-58060
[13] https://security-tracker.debian.org/tracker/CVE-2026-58061
https://www.cve.org/CVERecord?id=CVE-2026-58061
[14] https://security-tracker.debian.org/tracker/CVE-2026-58062
https://www.cve.org/CVERecord?id=CVE-2026-58062
[15] https://security-tracker.debian.org/tracker/CVE-2026-58063
https://www.cve.org/CVERecord?id=CVE-2026-58063
[16] https://security-tracker.debian.org/tracker/CVE-2026-59638
https://www.cve.org/CVERecord?id=CVE-2026-59638
[17] https://security-tracker.debian.org/tracker/CVE-2026-59639
https://www.cve.org/CVERecord?id=CVE-2026-59639
[18] https://security-tracker.debian.org/tracker/CVE-2026-59640
https://www.cve.org/CVERecord?id=CVE-2026-59640
[19] https://security-tracker.debian.org/tracker/CVE-2026-59641
https://www.cve.org/CVERecord?id=CVE-2026-59641
[20] https://security-tracker.debian.org/tracker/CVE-2026-59642
https://www.cve.org/CVERecord?id=CVE-2026-59642
[21] https://security-tracker.debian.org/tracker/CVE-2026-59643
https://www.cve.org/CVERecord?id=CVE-2026-59643
[22] https://security-tracker.debian.org/tracker/CVE-2026-59644
https://www.cve.org/CVERecord?id=CVE-2026-59644
[23] https://security-tracker.debian.org/tracker/CVE-2026-59645
https://www.cve.org/CVERecord?id=CVE-2026-59645
[24] https://security-tracker.debian.org/tracker/CVE-2026-59646
https://www.cve.org/CVERecord?id=CVE-2026-59646
[25] https://security-tracker.debian.org/tracker/CVE-2026-59647
https://www.cve.org/CVERecord?id=CVE-2026-59647
[26] https://security-tracker.debian.org/tracker/CVE-2026-59648
https://www.cve.org/CVERecord?id=CVE-2026-59648
[27] https://security-tracker.debian.org/tracker/CVE-2026-59649
https://www.cve.org/CVERecord?id=CVE-2026-59649
[28] https://security-tracker.debian.org/tracker/CVE-2026-59650
https://www.cve.org/CVERecord?id=CVE-2026-59650
[29] https://security-tracker.debian.org/tracker/CVE-2026-59651
https://www.cve.org/CVERecord?id=CVE-2026-59651
[30] https://security-tracker.debian.org/tracker/CVE-2026-59652
https://www.cve.org/CVERecord?id=CVE-2026-59652
[31] https://security-tracker.debian.org/tracker/CVE-2026-8763
https://www.cve.org/CVERecord?id=CVE-2026-8763

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
bouncycastle, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143536@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated bouncycastle package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 28 Sep 2026 09:35:25 +0200
Source: bouncycastle
Architecture: source
Version: 1.86-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1134195 1134196 1134343 1134386 1143536
Changes:
 bouncycastle (1.86-1) unstable; urgency=medium
 .
   * New upstream release
     - Fix CVE-2026-3505: unbounded AEAD chunk size in the OpenPGP v6 SEIPD
       packet parser (Closes: #1134195)
     - Fix CVE-2026-0636: LDAP injection in LDAPStoreHelper (Closes: #1134343)
     - Fix CVE-2026-5588: the PKIX draft CompositeVerifier accepted an empty
       signature sequence as valid (Closes: #1134196)
     - Fix CVE-2026-5598: non-constant time comparisons risked leaking the
       private key in FrodoKEM (Closes: #1134386)
     - Fix the 32 further CVEs reported against 1.80, fixed upstream in 1.85
       (Closes: #1143536)
     - Refreshed the patches
     - Updated the Maven poms
     - libbcpg-java now depends on libbcutil-java
   * Rewrote the watch file in the version 5 format
   * Removed the obsolete exclusions in debian/copyright
   * Removed the redundant Priority field
   * Standards-Version updated to 4.7.4
Checksums-Sha1:
 809e8ee70d187514a09a7b4377b4b2315246fed9 2461 bouncycastle_1.86-1.dsc
 f6e48fbf7032a1c2b6cf79bfa7b70857437fe7ad 8086256 bouncycastle_1.86.orig.tar.xz
 0cec97ab9063bf73b2935b7e4fa47ccdf036eab0 11248 bouncycastle_1.86-1.debian.tar.xz
 a856fdc3f8ba9d798efca700ce8e5c95c6d89b70 15411 bouncycastle_1.86-1_source.buildinfo
Checksums-Sha256:
 b509f702eab506cf5019d47a85eaed947a08be6b550fcbf2a26936f3533e10a3 2461 bouncycastle_1.86-1.dsc
 ec425b70f99be7d5ed69ae73244d693ce03ce0e0f6128b8f8f8cd40862b63072 8086256 bouncycastle_1.86.orig.tar.xz
 d4b75935401e3eb48dd8a2abff8c4236ef3666d37a72ed522f81dbfb62fd3359 11248 bouncycastle_1.86-1.debian.tar.xz
 c26652b33c51f3c10f466206e78fd651454ec313d962e89cd66a4bf2af4a2e65 15411 bouncycastle_1.86-1_source.buildinfo
Files:
 8686e04b846475719b887dcf6d3f00a4 2461 java optional bouncycastle_1.86-1.dsc
 8a36bc6a6835ffffc4d791de4b6046eb 8086256 java optional bouncycastle_1.86.orig.tar.xz
 f48d9cad94ff9d1427c2a79e559b103a 11248 java optional bouncycastle_1.86-1.debian.tar.xz
 e37af3f7ab0132c5c9cbef771bd8eaf3 15411 java optional bouncycastle_1.86-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmq6GdkSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsnnIP/06MOPZF6Fx/67ZCcCBFKkbLL5K7edix
d2sLD9NcyDHiBxrpZ4c/csy1RLRuNTE+h5F1RYqV1DEqWkviDbFm2FtPs4z/g83F
PL1V6cgJqzsSwZ2PJdNAaMsC3LdXziIjI3+tGzlR/u9cI1mwa1hCa+YSEtS5NcUB
7mVfGDCUze2xg/O8UjW407MY1hYggjVtUxlpdP/woY/PDYMD3dqtD5Lv3E/h6wgm
GqcbBqZRTJdiaTfTVIn2I1Ykh9++8kvaK1xZL0lpErRVFWI2sGq6D8MPiboxFVI2
LBD1uAPBpWYw/Ga0N9sNMgqeekm0fKDMHn+vm6i7G8UUG62Ux0WO3xRLsWGH4SE1
F/W0q9TE8Wvd+mrkJ7QZgNF7QENAfTXIZBX+iApmd/Jktikg2dikAduP268Zr0wd
QUpaBuh/8DcwD3pEj+3+ORzVHhvTFLdT32JnNcb0uD+5+LzV2Tqh+pKZF9VckjYH
+1D4PG1+jkPxIO4WpjcQi2y/hS/fUgpjZpPxDSBc3MZUO4fOo0a7GSwRLs2CHX38
RFkPxVV6xRUP7v7aM+jRbXD/rAx1cfLQ+r9aqW7CdDz0NN7CsBPrwYR9fuXSvjIc
FsQ/gR5XaJ8Ggu8CxImV8D8f5KfrPjDhATkpVf2bjqJhxSEy2/3miJx+tp49Lipp
GkzZlop7cz8V
=rvq9
-----END PGP SIGNATURE-----