{"schemaVersion":3,"id":"SUSE-SU-2026:23150-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for bouncycastle\n\nThis update for bouncycastle fixes the following issues:\n\nUpdate to 1.85.\n\nSecurity issues fixed:\n\n- CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI (bsc#1272700).\n- CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check (bsc#1272701).\n- CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption (bsc#1272702).\n- CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (bsc#1272703).\n- CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split (bsc#1272704).\n- CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data (bsc#1272705).\n- CVE-2026-12852: MLS wire decoder allocates attacker-declared opaque length before bounds check (bsc#1272707).\n- CVE-2026-12860: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (bsc#1272708).\n- CVE-2026-13506: Lazy ASN.1 sequence forcing resets nesting-depth guard (bsc#1272709).\n- CVE-2026-13586: PKCS#12 MAC and bag-decryption KDF iteration-count bound (bsc#1272710).\n- CVE-2026-14682: Possible OOM from unbounded up-front allocation on a definite-length read (bsc#1272711).\n- CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (bsc#1272712).\n- CVE-2026-58059: Quadratic-time escaping when stringifying X.500 distinguished names (bsc#1272713).\n- CVE-2026-58060: HSS public-key level count unbounded, enabling huge allocation on verify (bsc#1272714).\n- CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check (bsc#1272715).\n- CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate (bsc#1272716).\n- CVE-2026-58063: BCFKS keystore load honours unbounded KDF cost from untrusted file (bsc#1272717).\n- CVE-2026-59638: JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (bsc#1272718).\n- CVE-2026-59639: CMS verifySignatures returns true for SignedData with zero signers (bsc#1272719).\n- CVE-2026-59640: OpenPGP CFB quick-check oracle active on symmetric/session-key paths (bsc#1272720).\n- CVE-2026-59641: S/MIME validator trusts signer-asserted signingTime for path validation (bsc#1272721).\n- CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present (bsc#1272722).\n- CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored (bsc#1272723).\n- CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (bsc#1272724).\n- CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (bsc#1272725).\n- CVE-2026-59646: DTLS handshake reassembler allocates buffer from unchecked 24-bit length (bsc#1272726).\n- CVE-2026-59647: CRMF/CMP password-MAC honours unbounded iteration count (bsc#1272727).\n- CVE-2026-59648: OpenPGP Argon2 S2K honours attacker-chosen memory and passes (bsc#1272728).\n- CVE-2026-59649: OpenPGP user-attribute subpacket length bounded only by JVM max memory (bsc#1272729).\n- CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value (bsc#1272730).\n- CVE-2026-59651: BKS keystore accepts legacy version with 16-bit integrity MAC key (bsc#1272731).\n- CVE-2026-59652: LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (bsc#1272732).\n\nAdditional notes:\n\n- The standardised PQC algorithms ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, and CMCE have been repackaged under\n  `org.bouncycastle.crypto` and the versions under `org.bouncycastle.crypto.pqc` have been deprecated. These deprecated\n  versions will be removed in BC 1.86.","dates":{"published":"2026-08-06T07:40:53.000Z","modified":"2026-08-14T18:23:41.480Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server 16.0","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 1.85-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.85-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 1.85-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.85-160000.1.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623150-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202623150-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1272700","label":"bugzilla.suse.com/1272700","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272701","label":"bugzilla.suse.com/1272701","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272702","label":"bugzilla.suse.com/1272702","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272703","label":"bugzilla.suse.com/1272703","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272704","label":"bugzilla.suse.com/1272704","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272705","label":"bugzilla.suse.com/1272705","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272707","label":"bugzilla.suse.com/1272707","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272708","label":"bugzilla.suse.com/1272708","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272709","label":"bugzilla.suse.com/1272709","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272710","label":"bugzilla.suse.com/1272710","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272711","label":"bugzilla.suse.com/1272711","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272712","label":"bugzilla.suse.com/1272712","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272713","label":"bugzilla.suse.com/1272713","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272714","label":"bugzilla.suse.com/1272714","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272715","label":"bugzilla.suse.com/1272715","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272716","label":"bugzilla.suse.com/1272716","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272717","label":"bugzilla.suse.com/1272717","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272718","label":"bugzilla.suse.com/1272718","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272719","label":"bugzilla.suse.com/1272719","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272720","label":"bugzilla.suse.com/1272720","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272721","label":"bugzilla.suse.com/1272721","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272722","label":"bugzilla.suse.com/1272722","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272723","label":"bugzilla.suse.com/1272723","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272724","label":"bugzilla.suse.com/1272724","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272725","label":"bugzilla.suse.com/1272725","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272726","label":"bugzilla.suse.com/1272726","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272727","label":"bugzilla.suse.com/1272727","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272728","label":"bugzilla.suse.com/1272728","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272729","label":"bugzilla.suse.com/1272729","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272730","label":"bugzilla.suse.com/1272730","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272731","label":"bugzilla.suse.com/1272731","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272732","label":"bugzilla.suse.com/1272732","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12185","label":"www.suse.com/security/cve/CVE-2026-12185","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12802","label":"www.suse.com/security/cve/CVE-2026-12802","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12803","label":"www.suse.com/security/cve/CVE-2026-12803","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12816","label":"www.suse.com/security/cve/CVE-2026-12816","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12817","label":"www.suse.com/security/cve/CVE-2026-12817","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12852","label":"www.suse.com/security/cve/CVE-2026-12852","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12860","label":"www.suse.com/security/cve/CVE-2026-12860","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13506","label":"www.suse.com/security/cve/CVE-2026-13506","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13586","label":"www.suse.com/security/cve/CVE-2026-13586","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14682","label":"www.suse.com/security/cve/CVE-2026-14682","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15055","label":"www.suse.com/security/cve/CVE-2026-15055","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58059","label":"www.suse.com/security/cve/CVE-2026-58059","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58060","label":"www.suse.com/security/cve/CVE-2026-58060","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58061","label":"www.suse.com/security/cve/CVE-2026-58061","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58062","label":"www.suse.com/security/cve/CVE-2026-58062","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58063","label":"www.suse.com/security/cve/CVE-2026-58063","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59638","label":"www.suse.com/security/cve/CVE-2026-59638","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59639","label":"www.suse.com/security/cve/CVE-2026-59639","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59640","label":"www.suse.com/security/cve/CVE-2026-59640","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59641","label":"www.suse.com/security/cve/CVE-2026-59641","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59642","label":"www.suse.com/security/cve/CVE-2026-59642","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59643","label":"www.suse.com/security/cve/CVE-2026-59643","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59644","label":"www.suse.com/security/cve/CVE-2026-59644","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59645","label":"www.suse.com/security/cve/CVE-2026-59645","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59646","label":"www.suse.com/security/cve/CVE-2026-59646","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59647","label":"www.suse.com/security/cve/CVE-2026-59647","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59648","label":"www.suse.com/security/cve/CVE-2026-59648","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59649","label":"www.suse.com/security/cve/CVE-2026-59649","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59650","label":"www.suse.com/security/cve/CVE-2026-59650","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59651","label":"www.suse.com/security/cve/CVE-2026-59651","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59652","label":"www.suse.com/security/cve/CVE-2026-59652","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8763","label":"www.suse.com/security/cve/CVE-2026-8763","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-12185","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-12817","CVE-2026-12852","CVE-2026-12860","CVE-2026-13506","CVE-2026-13586","CVE-2026-14682","CVE-2026-15055","CVE-2026-58059","CVE-2026-58060","CVE-2026-58061","CVE-2026-58062","CVE-2026-58063","CVE-2026-59638","CVE-2026-59639","CVE-2026-59640","CVE-2026-59641","CVE-2026-59642","CVE-2026-59643","CVE-2026-59644","CVE-2026-59645","CVE-2026-59646","CVE-2026-59647","CVE-2026-59648","CVE-2026-59649","CVE-2026-59650","CVE-2026-59651","CVE-2026-59652","CVE-2026-8763"],"downstream":[],"duplicates":[],"related":["CVE-2026-12185","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-12817","CVE-2026-12852","CVE-2026-12860","CVE-2026-13506","CVE-2026-13586","CVE-2026-14682","CVE-2026-15055","CVE-2026-58059","CVE-2026-58060","CVE-2026-58061","CVE-2026-58062","CVE-2026-58063","CVE-2026-59638","CVE-2026-59639","CVE-2026-59640","CVE-2026-59641","CVE-2026-59642","CVE-2026-59643","CVE-2026-59644","CVE-2026-59645","CVE-2026-59646","CVE-2026-59647","CVE-2026-59648","CVE-2026-59649","CVE-2026-59650","CVE-2026-59651","CVE-2026-59652","CVE-2026-8763"]},"timeline":[{"kind":"published","date":"2026-08-06T07:40:53.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-14T18:23:41.480Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T22:14:29.530Z","stale":false,"partial":false}}