CVEvulnerability

CVE-2026-58062

9.3 CRITICAL Published 2026-08-03 Modified 2026-09-02 Official page ↗
Status
Analyzed
Published
2026-08-03
Last modified
2026-09-02
Assigner
91579145-5d7b-4cc5-b925-a0262ff19630
CVSS 4.0 (91579145-5d7b-4cc5-b925-a0262ff19630)
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295

Description

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected configurations

• bouncycastle bc-java (>= 1.66 < 1.85) • bouncycastle bouncy castle for java lts (<= 2.73.11) • bouncycastle fips java api (< 2.0.2) • bouncycastle fips java api (>= 2.1.0 < 2.1.3)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References