CVE-2026-59650

CriticalCVSS 9.1/10Last modified Aug 31, 2026

Description

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Legion of the Bouncy Castle Inc.	BC-JAVA	< 1.85
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	>= 2.73.0, < 2.73.12

References

Timeline

Published: Aug 3, 2026
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-596517.5In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Cas CVE-2026-596526.5In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.CVE-2026-596547.5Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affe CVE-2026-596557.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OA CVE-2026-596577.5Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apa CVE-2026-596594.8Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric CVE-2026-59668.1ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attackers with web access CVE-2026-596604.8Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric CVE-2026-596614.8Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric CVE-2026-596624.8Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric CVE-2026-596634.8Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric CVE-2026-596644.8Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric