CVE-2026-58059

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 1.0.2.7 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.0.2 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3

Description Quadratic-time escaping occurs when stringifying X.500 distinguished names. This behavior can lead to excessive resource consumption during the string conversion process.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 1.0.X series to version 1.0.2.7 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.0.X series to version 2.0.2 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.1.X series to version 2.1.3 or later.