Bcpg-fips vulnerabilities

3 known vulnerabilities in Bcpg-fips from Bouncycastle. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  BC-JAVA: Improper Validation of Integrity Check Value

  CVE-2026-12817Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.

• 7.5 High severity

  BC-JAVA: Memory Allocation with Excessive Size Value

  CVE-2026-59649Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2

• 7.5 High severity

  BC-JAVA: Improper Verification of Cryptographic Signature

  CVE-2026-59643Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.