CVE-2026-14682

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bc-fips versions prior to 1.0.2.7 Bouncy Castle for Java FIPS (BC-FJA) bc-fips versions prior to 2.0.2 Bouncy Castle for Java FIPS (BC-FJA) bc-fips versions prior to 2.1.3 bctls-fips versions prior to 1.0.24

Description An issue exists where an unbounded up-front allocation during a definite-length read can lead to an Out of Memory (OOM) condition. OOM occurs when the system cannot allocate enough memory to perform an operation, potentially causing the application to crash.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bc-fips 1.0.X series to version 1.0.2.7 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bc-fips 2.0.X series to version 2.0.2 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bc-fips 2.1.X series to version 2.1.3 or later. Update bctls-fips to version 1.0.24 or later.