CVE-2026-59640

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips versions prior to 2.0.13 Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips versions prior to 2.1.13

Description An OpenPGP CFB quick-check oracle is active on symmetric/session-key paths. A check oracle is a type of side-channel attack where an attacker can deduce information about the encrypted data by observing the system's response to specifically crafted inputs.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips to version 1.0.13 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips to version 2.0.13 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips to version 2.1.13 or later for the 2.1.X series.