Bcpkix-fips vulnerabilities

4 known vulnerabilities in Bcpkix-fips from Bouncycastle. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  BC-JAVA: Improper Validation of Integrity Check Value

  CVE-2026-12802Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12

• 7.5 High severity

  BC-JAVA: Improper Validation of Integrity Check Value

  CVE-2026-59642Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series),

• 7.5 High severity

  BC-JAVA: Improper Verification of Cryptographic Signature

  CVE-2026-59639Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0

• 8.2 High severity

  BC-JAVA: Allocation of Resources Without Limits or Throttling

  CVE-2026-15055Aug 3, 2026Legion of the Bouncy Castle

  In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12