CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 19.8%

CVSS Severity

CVSS v3 Score 7.5

References

Products affected by CVE-2026-59649

Bouncycastle » Bc-Java » Version: N/A

cpe:2.3:a:bouncycastle:bc-java:-
Bouncycastle » Bc-Java » Version: 1.01

cpe:2.3:a:bouncycastle:bc-java:1.01
Bouncycastle » Bc-Java » Version: 1.02

cpe:2.3:a:bouncycastle:bc-java:1.02
Bouncycastle » Bc-Java » Version: 1.03

cpe:2.3:a:bouncycastle:bc-java:1.03
Bouncycastle » Bc-Java » Version: 1.04

cpe:2.3:a:bouncycastle:bc-java:1.04
Bouncycastle » Bc-Java » Version: 1.05

cpe:2.3:a:bouncycastle:bc-java:1.05
Bouncycastle » Bc-Java » Version: 1.06

cpe:2.3:a:bouncycastle:bc-java:1.06
Bouncycastle » Bc-Java » Version: 1.07

cpe:2.3:a:bouncycastle:bc-java:1.07
Bouncycastle » Bc-Java » Version: 1.08

cpe:2.3:a:bouncycastle:bc-java:1.08
Bouncycastle » Bc-Java » Version: 1.09

cpe:2.3:a:bouncycastle:bc-java:1.09
Bouncycastle » Bc-Java » Version: 1.10

cpe:2.3:a:bouncycastle:bc-java:1.10
Bouncycastle » Bc-Java » Version: 1.11

cpe:2.3:a:bouncycastle:bc-java:1.11
Bouncycastle » Bc-Java » Version: 1.12

cpe:2.3:a:bouncycastle:bc-java:1.12
Bouncycastle » Bc-Java » Version: 1.13

cpe:2.3:a:bouncycastle:bc-java:1.13
Bouncycastle » Bc-Java » Version: 1.14

cpe:2.3:a:bouncycastle:bc-java:1.14
Bouncycastle » Bc-Java » Version: 1.15

cpe:2.3:a:bouncycastle:bc-java:1.15
Bouncycastle » Bc-Java » Version: 1.16

cpe:2.3:a:bouncycastle:bc-java:1.16
Bouncycastle » Bc-Java » Version: 1.17

cpe:2.3:a:bouncycastle:bc-java:1.17
Bouncycastle » Bc-Java » Version: 1.18

cpe:2.3:a:bouncycastle:bc-java:1.18
Bouncycastle » Bc-Java » Version: 1.19

cpe:2.3:a:bouncycastle:bc-java:1.19
Bouncycastle » Bc-Java » Version: 1.20

cpe:2.3:a:bouncycastle:bc-java:1.20
Bouncycastle » Bc-Java » Version: 1.21

cpe:2.3:a:bouncycastle:bc-java:1.21
Bouncycastle » Bc-Java » Version: 1.22

cpe:2.3:a:bouncycastle:bc-java:1.22
Bouncycastle » Bc-Java » Version: 1.23

cpe:2.3:a:bouncycastle:bc-java:1.23
Bouncycastle » Bc-Java » Version: 1.24

cpe:2.3:a:bouncycastle:bc-java:1.24
Bouncycastle » Bc-Java » Version: 1.25

cpe:2.3:a:bouncycastle:bc-java:1.25
Bouncycastle » Bc-Java » Version: 1.26

cpe:2.3:a:bouncycastle:bc-java:1.26
Bouncycastle » Bc-Java » Version: 1.27

cpe:2.3:a:bouncycastle:bc-java:1.27
Bouncycastle » Bc-Java » Version: 1.28

cpe:2.3:a:bouncycastle:bc-java:1.28
Bouncycastle » Bc-Java » Version: 1.29

cpe:2.3:a:bouncycastle:bc-java:1.29
Bouncycastle » Bc-Java » Version: 1.30

cpe:2.3:a:bouncycastle:bc-java:1.30
Bouncycastle » Bc-Java » Version: 1.31

cpe:2.3:a:bouncycastle:bc-java:1.31
Bouncycastle » Bc-Java » Version: 1.32

cpe:2.3:a:bouncycastle:bc-java:1.32
Bouncycastle » Bc-Java » Version: 1.33

cpe:2.3:a:bouncycastle:bc-java:1.33
Bouncycastle » Bc-Java » Version: 1.34

cpe:2.3:a:bouncycastle:bc-java:1.34
Bouncycastle » Bc-Java » Version: 1.35

cpe:2.3:a:bouncycastle:bc-java:1.35
Bouncycastle » Bc-Java » Version: 1.36

cpe:2.3:a:bouncycastle:bc-java:1.36
Bouncycastle » Bc-Java » Version: 1.37

cpe:2.3:a:bouncycastle:bc-java:1.37
Bouncycastle » Bc-Java » Version: 1.38

cpe:2.3:a:bouncycastle:bc-java:1.38
Bouncycastle » Bc-Java » Version: 1.39

cpe:2.3:a:bouncycastle:bc-java:1.39
Bouncycastle » Bc-Java » Version: 1.40

cpe:2.3:a:bouncycastle:bc-java:1.40
Bouncycastle » Bc-Java » Version: 1.41

cpe:2.3:a:bouncycastle:bc-java:1.41
Bouncycastle » Bc-Java » Version: 1.42

cpe:2.3:a:bouncycastle:bc-java:1.42
Bouncycastle » Bc-Java » Version: 1.43

cpe:2.3:a:bouncycastle:bc-java:1.43
Bouncycastle » Bc-Java » Version: 1.44

cpe:2.3:a:bouncycastle:bc-java:1.44
Bouncycastle » Bc-Java » Version: 1.45

cpe:2.3:a:bouncycastle:bc-java:1.45
Bouncycastle » Bc-Java » Version: 1.46

cpe:2.3:a:bouncycastle:bc-java:1.46
Bouncycastle » Bc-Java » Version: 1.47

cpe:2.3:a:bouncycastle:bc-java:1.47
Bouncycastle » Bc-Java » Version: 1.48

cpe:2.3:a:bouncycastle:bc-java:1.48
Bouncycastle » Bc-Java » Version: 1.49

cpe:2.3:a:bouncycastle:bc-java:1.49
Bouncycastle » Bc-Java » Version: 1.50

cpe:2.3:a:bouncycastle:bc-java:1.50
Bouncycastle » Bc-Java » Version: 1.51

cpe:2.3:a:bouncycastle:bc-java:1.51
Bouncycastle » Bc-Java » Version: 1.52

cpe:2.3:a:bouncycastle:bc-java:1.52
Bouncycastle » Bc-Java » Version: 1.53

cpe:2.3:a:bouncycastle:bc-java:1.53
Bouncycastle » Bc-Java » Version: 1.54

cpe:2.3:a:bouncycastle:bc-java:1.54
Bouncycastle » Bc-Java » Version: 1.55

cpe:2.3:a:bouncycastle:bc-java:1.55
Bouncycastle » Bc-Java » Version: 1.56

cpe:2.3:a:bouncycastle:bc-java:1.56
Bouncycastle » Bc-Java » Version: 1.57

cpe:2.3:a:bouncycastle:bc-java:1.57
Bouncycastle » Bc-Java » Version: 1.58

cpe:2.3:a:bouncycastle:bc-java:1.58
Bouncycastle » Bc-Java » Version: 1.59

cpe:2.3:a:bouncycastle:bc-java:1.59
Bouncycastle » Bc-Java » Version: 1.60

cpe:2.3:a:bouncycastle:bc-java:1.60
Bouncycastle » Bc-Java » Version: 1.61

cpe:2.3:a:bouncycastle:bc-java:1.61
Bouncycastle » Bc-Java » Version: 1.62

cpe:2.3:a:bouncycastle:bc-java:1.62
Bouncycastle » Bc-Java » Version: 1.63

cpe:2.3:a:bouncycastle:bc-java:1.63
Bouncycastle » Bc-Java » Version: 1.64

cpe:2.3:a:bouncycastle:bc-java:1.64
Bouncycastle » Bc-Java » Version: 1.65

cpe:2.3:a:bouncycastle:bc-java:1.65
Bouncycastle » Bc-Java » Version: 1.66

cpe:2.3:a:bouncycastle:bc-java:1.66
Bouncycastle » Bc-Java » Version: 1.67

cpe:2.3:a:bouncycastle:bc-java:1.67
Bouncycastle » Bc-Java » Version: 1.68

cpe:2.3:a:bouncycastle:bc-java:1.68
Bouncycastle » Bc-Java » Version: 1.69

cpe:2.3:a:bouncycastle:bc-java:1.69
Bouncycastle » Bc-Java » Version: 1.70

cpe:2.3:a:bouncycastle:bc-java:1.70
Bouncycastle » Bc-Java » Version: 1.71

cpe:2.3:a:bouncycastle:bc-java:1.71
Bouncycastle » Bc-Java » Version: 1.72

cpe:2.3:a:bouncycastle:bc-java:1.72
Bouncycastle » Bc-Java » Version: 1.72.1

cpe:2.3:a:bouncycastle:bc-java:1.72.1
Bouncycastle » Bc-Java » Version: 1.72.2

cpe:2.3:a:bouncycastle:bc-java:1.72.2
Bouncycastle » Bc-Java » Version: 1.73

cpe:2.3:a:bouncycastle:bc-java:1.73
Bouncycastle » Bc-Java » Version: 1.74

cpe:2.3:a:bouncycastle:bc-java:1.74
Bouncycastle » Bc-Java » Version: 1.75

cpe:2.3:a:bouncycastle:bc-java:1.75
Bouncycastle » Bc-Java » Version: 1.76

cpe:2.3:a:bouncycastle:bc-java:1.76
Bouncycastle » Bc-Java » Version: 1.77

cpe:2.3:a:bouncycastle:bc-java:1.77
Bouncycastle » Bc-Java » Version: 1.78

cpe:2.3:a:bouncycastle:bc-java:1.78
Bouncycastle » Bc-Java » Version: 1.78.1

cpe:2.3:a:bouncycastle:bc-java:1.78.1
Bouncycastle » Bc-Java » Version: 1.79

cpe:2.3:a:bouncycastle:bc-java:1.79
Bouncycastle » Bc-Java » Version: 1.80

cpe:2.3:a:bouncycastle:bc-java:1.80
Bouncycastle » Bc-Java » Version: 1.81

cpe:2.3:a:bouncycastle:bc-java:1.81
Bouncycastle » Bc-Java » Version: 1.82

cpe:2.3:a:bouncycastle:bc-java:1.82
Bouncycastle » Bc-Java » Version: 1.83

cpe:2.3:a:bouncycastle:bc-java:1.83
Bouncycastle » Bc-Java » Version: 1.84

cpe:2.3:a:bouncycastle:bc-java:1.84
Bouncycastle » Bcpg-Fips » Version: 1.0.0

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.0
Bouncycastle » Bcpg-Fips » Version: 1.0.1

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.1
Bouncycastle » Bcpg-Fips » Version: 1.0.2

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.2
Bouncycastle » Bcpg-Fips » Version: 1.0.3

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.3
Bouncycastle » Bcpg-Fips » Version: 1.0.4

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.4
Bouncycastle » Bcpg-Fips » Version: 1.0.5

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.5
Bouncycastle » Bcpg-Fips » Version: 1.0.5.1

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.5.1
Bouncycastle » Bcpg-Fips » Version: 1.0.6

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.6
Bouncycastle » Bcpg-Fips » Version: 1.0.7.1

cpe:2.3:a:bouncycastle:bcpg-fips:1.0.7.1
Bouncycastle » Bcpg-Fips » Version: 2.0.10

cpe:2.3:a:bouncycastle:bcpg-fips:2.0.10
Bouncycastle » Bcpg-Fips » Version: 2.0.11

cpe:2.3:a:bouncycastle:bcpg-fips:2.0.11
Bouncycastle » Bcpg-Fips » Version: 2.0.12

cpe:2.3:a:bouncycastle:bcpg-fips:2.0.12
Bouncycastle » Bcpg-Fips » Version: 2.0.8

cpe:2.3:a:bouncycastle:bcpg-fips:2.0.8
Bouncycastle » Bcpg-Fips » Version: 2.0.9

cpe:2.3:a:bouncycastle:bcpg-fips:2.0.9
Bouncycastle » Bcpg-Fips » Version: 2.1.10

cpe:2.3:a:bouncycastle:bcpg-fips:2.1.10
Bouncycastle » Bcpg-Fips » Version: 2.1.11

cpe:2.3:a:bouncycastle:bcpg-fips:2.1.11
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.0

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.0
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.1

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.1
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.10

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.10
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.11

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.11
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.2

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.2
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.3

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.3
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.4

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.4
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.5

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.5
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.6

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.6
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.7

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.7
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.8

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.8
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.9

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-59649

Products

Pricing

Contact Us