CVE-2026-8149

MediumCVSS 5.1/10Last modified Oct 26, 2026

Description

A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f.

This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.

This issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.1.0 before 2.1.3.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:M/U:Amber

Weakness enumeration

CWE-1068

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Legion of the Bouncy Castle Inc.BC-LTS>= 2.73.0, < 2.73.11
Legion of the Bouncy Castle Inc.BC-FJA>= 2.1.0, < 2.1.3

References

Timeline

Published
May 8, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-814907.7A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop funCVE-2026-814917.3A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_CVE-2026-815057.1Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizesCVE-2026-815076.5ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroidCVE-2026-815084.3ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dpCVE-2026-815096.1nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1CVE-2026-81515.4The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackersCVE-2026-815157.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 untiCVE-2026-815167.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 untiCVE-2026-815177.5An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection loCVE-2026-815187.5When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake bCVE-2026-81529.3Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spa
CVE-2026-8149: Medium severity, CVSS 5.1 | Vulnix