CVE-2026-58062: In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12,
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-58062
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-58062 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for In Bouncy Castle
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-58063: In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from unt…nvd · 2026-08-03
- unknownCVE-2026-58061: In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer befor…nvd · 2026-08-03
- unknownCVE-2026-58060: In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge all…nvd · 2026-08-03
- unknownCVE-2026-58059: In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 disting…nvd · 2026-08-03
- unknownCVE-2026-8763: In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name a…nvd · 2026-08-03
- unknownCVE-2026-59652: In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.nvd · 2026-08-03
More from NVD Recent CVEs
- unknownCVE-2026-58063: In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from unt…2026-08-03
- unknownCVE-2026-58061: In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer befor…2026-08-03
- unknownCVE-2026-58060: In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge all…2026-08-03
- unknownCVE-2026-58059: In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 disting…2026-08-03
- unknownCVE-2026-20498: In geniezone, there is a possible escalation of privilege due to a missing permission check. T…2026-08-03