PT-2026-51268 · Unknown · Bouncy Castle For Java+1

Thai Duong

·

CVE-2026-12802

·

Published

2026-06-21

·

Updated

2026-08-24

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 1.0.12 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 2.0.12 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 2.1.12
Description CMS AuthEnvelopedData fails to enforce tag-length during the decryption process.
Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 1.0.12 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 2.0.12 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 2.1.12 or later for the 2.1.X series.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2026-12802
OPENSUSE-SU-2026:11445-1
OPENSUSE-SU-2026:21538-1
SUSE-SU-2026:23127-1
SUSE-SU-2026:23150-1
SUSE-SU-2026:3559-1

Affected Products

Bouncy Castle For Java
Bcpkix Fips