GitHub Advisoryadvisory · Maven

GHSA-qp49-qgx5-5m26 Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

HIGH Published 2026-08-03 Modified 2026-09-18 Official page ↗
Aliases
CVE-2026-13506
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bc-fips, org.bouncycastle:bcprov-lts8on, org.bouncycastle:bcprov-jdk15to18
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674
Reviewed
2026-09-18

Affected packages

• Maven org.bouncycastle:bcprov-jdk18on: < 1.85 → fixed in 1.85 • Maven org.bouncycastle:bc-fips: < 1.0.2.7 → fixed in 1.0.2.7 • Maven org.bouncycastle:bc-fips: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • Maven org.bouncycastle:bc-fips: >= 2.1.0, < 2.1.3 → fixed in 2.1.3 • Maven org.bouncycastle:bcprov-lts8on: < 2.73.12 → fixed in 2.73.12 • Maven org.bouncycastle:bcprov-jdk15to18: < 1.85 → fixed in 1.85

Description

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Related

Alias · CVE (1)

  • CVE-2026-13506 In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References