Vulnerability Details CVE-2026-58060
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 31.7%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-58060
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.0
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.1
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.10
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.11
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.2
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.3
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.4
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.5
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.6
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.7
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.8
-
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.9
-
cpe:2.3:a:bouncycastle:fips_java_api:-
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.0
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.1
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.1.2
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.1
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.2
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.3
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.4
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.5
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.6
-
cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.7
-
cpe:2.3:a:bouncycastle:fips_java_api:1.1.0
-
cpe:2.3:a:bouncycastle:fips_java_api:2.0.0
-
cpe:2.3:a:bouncycastle:fips_java_api:2.0.1
-
cpe:2.3:a:bouncycastle:fips_java_api:2.1.0
-
cpe:2.3:a:bouncycastle:fips_java_api:2.1.1
-
cpe:2.3:a:bouncycastle:fips_java_api:2.1.2