Fips Java API vulnerabilities

8 known vulnerabilities in Fips Java API from Bouncycastle. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

8vulnerabilities

2critical

6high

0exploited

7.9average CVSS score

Latest first

7.5 High severity
BC-JAVA: Memory Allocation with Excessive Size Value
CVE-2026-14682Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series),
7.5 High severity
BC-JAVA: Allocation of Resources Without Limits or Throttling
CVE-2026-13586Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0
7.5 High severity
BC-JAVA: Uncontrolled Recursion
CVE-2026-13506Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X serie
9.1 Critical severity
BC-JAVA: Improper Certificate Validation
CVE-2026-58062Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) an
7.5 High severity
BC-JAVA: Improper Validation of Integrity Check Value
CVE-2026-58061Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
7.5 High severity
BC-JAVA: Memory Allocation with Excessive Size Value
CVE-2026-58060Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and
7.5 High severity
BC-JAVA: Inefficient Algorithmic Complexity
CVE-2026-58059Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2
9.1 Critical severity
BC-JAVA: Improper Certificate Validation
CVE-2026-8763Aug 3, 2026Legion of the Bouncy Castle
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0