CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-58060

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Exploit prediction scoring system (EPSS) score

EPSS Score 0.007

EPSS Ranking 49.8%

CVSS Severity

CVSS v3 Score 7.5

References

Products affected by CVE-2026-58060

Bouncycastle » Bc-Java » Version: 1.65

cpe:2.3:a:bouncycastle:bc-java:1.65
Bouncycastle » Bc-Java » Version: 1.66

cpe:2.3:a:bouncycastle:bc-java:1.66
Bouncycastle » Bc-Java » Version: 1.67

cpe:2.3:a:bouncycastle:bc-java:1.67
Bouncycastle » Bc-Java » Version: 1.68

cpe:2.3:a:bouncycastle:bc-java:1.68
Bouncycastle » Bc-Java » Version: 1.69

cpe:2.3:a:bouncycastle:bc-java:1.69
Bouncycastle » Bc-Java » Version: 1.70

cpe:2.3:a:bouncycastle:bc-java:1.70
Bouncycastle » Bc-Java » Version: 1.71

cpe:2.3:a:bouncycastle:bc-java:1.71
Bouncycastle » Bc-Java » Version: 1.72

cpe:2.3:a:bouncycastle:bc-java:1.72
Bouncycastle » Bc-Java » Version: 1.72.1

cpe:2.3:a:bouncycastle:bc-java:1.72.1
Bouncycastle » Bc-Java » Version: 1.72.2

cpe:2.3:a:bouncycastle:bc-java:1.72.2
Bouncycastle » Bc-Java » Version: 1.73

cpe:2.3:a:bouncycastle:bc-java:1.73
Bouncycastle » Bc-Java » Version: 1.74

cpe:2.3:a:bouncycastle:bc-java:1.74
Bouncycastle » Bc-Java » Version: 1.75

cpe:2.3:a:bouncycastle:bc-java:1.75
Bouncycastle » Bc-Java » Version: 1.76

cpe:2.3:a:bouncycastle:bc-java:1.76
Bouncycastle » Bc-Java » Version: 1.77

cpe:2.3:a:bouncycastle:bc-java:1.77
Bouncycastle » Bc-Java » Version: 1.78

cpe:2.3:a:bouncycastle:bc-java:1.78
Bouncycastle » Bc-Java » Version: 1.78.1

cpe:2.3:a:bouncycastle:bc-java:1.78.1
Bouncycastle » Bc-Java » Version: 1.79

cpe:2.3:a:bouncycastle:bc-java:1.79
Bouncycastle » Bc-Java » Version: 1.80

cpe:2.3:a:bouncycastle:bc-java:1.80
Bouncycastle » Bc-Java » Version: 1.81

cpe:2.3:a:bouncycastle:bc-java:1.81
Bouncycastle » Bc-Java » Version: 1.82

cpe:2.3:a:bouncycastle:bc-java:1.82
Bouncycastle » Bc-Java » Version: 1.83

cpe:2.3:a:bouncycastle:bc-java:1.83
Bouncycastle » Bc-Java » Version: 1.84

cpe:2.3:a:bouncycastle:bc-java:1.84
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.0

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.0
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.1

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.1
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.10

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.10
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.11

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.11
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.2

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.2
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.3

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.3
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.4

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.4
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.5

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.5
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.6

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.6
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.7

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.7
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.8

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.8
Bouncycastle » Bouncy Castle For Java Lts » Version: 2.73.9

cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:2.73.9
Bouncycastle » Fips Java Api » Version: N/A

cpe:2.3:a:bouncycastle:fips_java_api:-
Bouncycastle » Fips Java Api » Version: 1.0.0

cpe:2.3:a:bouncycastle:fips_java_api:1.0.0
Bouncycastle » Fips Java Api » Version: 1.0.1

cpe:2.3:a:bouncycastle:fips_java_api:1.0.1
Bouncycastle » Fips Java Api » Version: 1.0.1.2

cpe:2.3:a:bouncycastle:fips_java_api:1.0.1.2
Bouncycastle » Fips Java Api » Version: 1.0.2

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2
Bouncycastle » Fips Java Api » Version: 1.0.2.1

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.1
Bouncycastle » Fips Java Api » Version: 1.0.2.2

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.2
Bouncycastle » Fips Java Api » Version: 1.0.2.3

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.3
Bouncycastle » Fips Java Api » Version: 1.0.2.4

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.4
Bouncycastle » Fips Java Api » Version: 1.0.2.5

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.5
Bouncycastle » Fips Java Api » Version: 1.0.2.6

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.6
Bouncycastle » Fips Java Api » Version: 1.0.2.7

cpe:2.3:a:bouncycastle:fips_java_api:1.0.2.7
Bouncycastle » Fips Java Api » Version: 1.1.0

cpe:2.3:a:bouncycastle:fips_java_api:1.1.0
Bouncycastle » Fips Java Api » Version: 2.0.0

cpe:2.3:a:bouncycastle:fips_java_api:2.0.0
Bouncycastle » Fips Java Api » Version: 2.0.1

cpe:2.3:a:bouncycastle:fips_java_api:2.0.1
Bouncycastle » Fips Java Api » Version: 2.1.0

cpe:2.3:a:bouncycastle:fips_java_api:2.1.0
Bouncycastle » Fips Java Api » Version: 2.1.1

cpe:2.3:a:bouncycastle:fips_java_api:2.1.1
Bouncycastle » Fips Java Api » Version: 2.1.2

cpe:2.3:a:bouncycastle:fips_java_api:2.1.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-58060

Products

Pricing

Contact Us