GHSA-qp49-qgx5-5m26HighCVSS 7.5

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

Published
August 3, 2026
Last Modified
September 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-13506 →

📋 Description

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

🎯 Affected products6

  • maven/org.bouncycastle:bcprov-jdk18on:< 1.85
  • maven/org.bouncycastle:bc-fips:< 1.0.2.7
  • maven/org.bouncycastle:bc-fips:>= 2.0.0, < 2.0.2
  • maven/org.bouncycastle:bc-fips:>= 2.1.0, < 2.1.3
  • maven/org.bouncycastle:bcprov-lts8on:< 2.73.12
  • maven/org.bouncycastle:bcprov-jdk15to18:< 1.85

🔗 References (4)