SUSE-SU-2026:4797-1: bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4797-1 is a vulnerability in bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 21-10-2026
   PublishedVulnerability first disclosed.
2. 21-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for bouncycastle This update for bouncycastle fixes the following issues: - CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion (bsc#1284075). - CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion (bsc#1284073). - CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing side-channel attacks (bsc#1284065). - CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel leaks (bsc#1284205). - CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation and group message interception (bsc#1284165). - CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust delegations and identity spoofing (bsc#1284212). - CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature misattribution and trust context spoofing (bsc#1284213). - CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause unauthenticated attribute injection (bsc#1284215). - CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name constraint bypasses (bsc#1284218). - CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member eviction and session takeover (bsc#1284219). - CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature verification bypasses (bsc#1284220). - CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses for HKDF-derived content keys (bsc#1284221). - CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered truncation errors and integrity check bypasses (bsc#1284222). - CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause resource exhaustion (bsc#1284224). Changes for bouncycastle: - Updated to version 1.86.

No weakness data has been published for this record.