CVE-2026-59649

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips versions prior to 2.0.13 Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips versions prior to 2.1.13

Description An issue exists where the OpenPGP user-attribute subpacket length is bounded only by the maximum memory available to the Java Virtual Machine (JVM), which is the engine that provides a runtime environment to execute Java bytecode.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips to version 1.0.13 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips to version 2.0.13 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips to version 2.1.13 or later for the 2.1.X series.