CVE-2026-59646

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bctls-fips versions prior to 1.0.24 Bouncy Castle for Java FIPS (BC-FJA) bctls-fips versions prior to 2.0.24 Bouncy Castle for Java FIPS (BC-FJA) bctls-fips versions prior to 2.1.24

Description The DTLS handshake reassembler allocates a buffer based on an unchecked 24-bit length, which can lead to resource exhaustion or memory issues.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bctls-fips 1.0.X series to version 1.0.24 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bctls-fips 2.0.X series to version 2.0.24 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bctls-fips 2.1.X series to version 2.1.24 or later.