CVE-2026-59638

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bctls-fips versions prior to 1.0.24 Bouncy Castle for Java FIPS (BC-FJA) bctls-fips versions prior to 2.0.24 Bouncy Castle for Java FIPS (BC-FJA) bctls-fips versions prior to 2.1.24

Description The JSSE hostname verifier CN-fallback is enabled by default, contradicting the documented requirement for an opt-in configuration. CN-fallback is a mechanism where the verifier falls back to checking the Common Name (CN) of the certificate if the Subject Alternative Name (SAN) is missing.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bctls-fips to version 1.0.24 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bctls-fips to version 2.0.24 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bctls-fips to version 2.1.24 or later for the 2.1.X series.