{"schemaVersion":3,"id":"SUSE-SU-2026:4797-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for bouncycastle\n\nThis update for bouncycastle fixes the following issues:\n\n- CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion\n  (bsc#1284075).\n- CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion (bsc#1284073).\n- CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing side-channel\n  attacks (bsc#1284065).\n- CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel leaks\n  (bsc#1284205).\n- CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation and group\n  message interception (bsc#1284165).\n- CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust delegations and\n  identity spoofing (bsc#1284212).\n- CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature misattribution and trust\n  context spoofing (bsc#1284213).\n- CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause unauthenticated attribute\n  injection (bsc#1284215).\n- CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name constraint bypasses\n  (bsc#1284218).\n- CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member eviction and\n  session takeover (bsc#1284219).\n- CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature verification bypasses\n  (bsc#1284220).\n- CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses for HKDF-derived\n  content keys (bsc#1284221).\n- CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered truncation errors\n  and integrity check bypasses (bsc#1284222).\n- CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause resource\n  exhaustion (bsc#1284224).\n\nChanges for bouncycastle:\n\n- Updated to version 1.86.","dates":{"published":"2026-10-21T07:54:59.000Z","modified":"2026-10-21T20:02:15.286Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null},{"vendor":"suse","product":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"bouncycastle","label":"bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/bouncycastle&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 1.86-150200.3.41.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.86-150200.3.41.1","eol":null,"hubHref":null}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264797-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20264797-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1284065","label":"bugzilla.suse.com/1284065","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284073","label":"bugzilla.suse.com/1284073","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284075","label":"bugzilla.suse.com/1284075","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284165","label":"bugzilla.suse.com/1284165","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284205","label":"bugzilla.suse.com/1284205","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284212","label":"bugzilla.suse.com/1284212","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284213","label":"bugzilla.suse.com/1284213","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284215","label":"bugzilla.suse.com/1284215","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284218","label":"bugzilla.suse.com/1284218","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284219","label":"bugzilla.suse.com/1284219","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284220","label":"bugzilla.suse.com/1284220","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284221","label":"bugzilla.suse.com/1284221","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284222","label":"bugzilla.suse.com/1284222","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1284224","label":"bugzilla.suse.com/1284224","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17507","label":"www.suse.com/security/cve/CVE-2026-17507","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17508","label":"www.suse.com/security/cve/CVE-2026-17508","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18036","label":"www.suse.com/security/cve/CVE-2026-18036","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18040","label":"www.suse.com/security/cve/CVE-2026-18040","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71885","label":"www.suse.com/security/cve/CVE-2026-71885","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71886","label":"www.suse.com/security/cve/CVE-2026-71886","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71887","label":"www.suse.com/security/cve/CVE-2026-71887","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71888","label":"www.suse.com/security/cve/CVE-2026-71888","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71889","label":"www.suse.com/security/cve/CVE-2026-71889","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71890","label":"www.suse.com/security/cve/CVE-2026-71890","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71891","label":"www.suse.com/security/cve/CVE-2026-71891","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71892","label":"www.suse.com/security/cve/CVE-2026-71892","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85515","label":"www.suse.com/security/cve/CVE-2026-85515","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97873","label":"www.suse.com/security/cve/CVE-2026-97873","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-17507","CVE-2026-17508","CVE-2026-18036","CVE-2026-18040","CVE-2026-71885","CVE-2026-71886","CVE-2026-71887","CVE-2026-71888","CVE-2026-71889","CVE-2026-71890","CVE-2026-71891","CVE-2026-71892","CVE-2026-85515","CVE-2026-97873"],"downstream":[],"duplicates":[],"related":["CVE-2026-17507","CVE-2026-17508","CVE-2026-18036","CVE-2026-18040","CVE-2026-71885","CVE-2026-71886","CVE-2026-71887","CVE-2026-71888","CVE-2026-71889","CVE-2026-71890","CVE-2026-71891","CVE-2026-71892","CVE-2026-85515","CVE-2026-97873"]},"timeline":[{"kind":"published","date":"2026-10-21T07:54:59.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-21T20:02:15.286Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:35:57.692Z","stale":false,"partial":false}}