Description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).
This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Legion of the Bouncy Castle | BC-JAVA | 1.67 – < 1.80.2, 1.81 – < 1.81.1, 1.82 – < 1.84 | 1.80.2 |
| Legion of the Bouncy Castle | BCPKIX-FIPS | 2.0.6 – < 2.0.11, 2.1.7 – < 2.1.11 | 2.0.11 |
| Legion of the Bouncy Castle | BCPIX-LTS | 2.73.7 – < 2.73.11 | 2.73.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bouncycastle | 1.86-1 | — |
| Debian 13 | bouncycastle | No fix yet | — |
| Debian 12 | bouncycastle | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | bouncycastle | No fix yet | — |
| Ubuntu 26.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu 25.10 | bouncycastle | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 22.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 20.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 18.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | bouncycastle | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.20-1.redhat_00001.1.el7sso | RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-activemq-artemis +15 | 2.16.0-22.redhat_00057.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-glassfish-jsf | 2.3.14-11.SP11_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-ironjacamar +8 | 1.5.26-2.Final_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jackson-core +10 | 2.18.8-1.redhat_00003.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-remoting | 5.0.31-3.SP2_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-server-migration +2 | 1.10.0-46.Final_redhat_00044.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.135-1.Final_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-api +7 | 2.5.5-24.SP12_redhat_00016.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-bindings +1 | 2.5.5-30.SP12_redhat_00020.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.40-1.SP3_redhat_00001.1.el8eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.25-2.GA_redhat_00001.1.el7eap | RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.25-2.GA_redhat_00001.1.el8eap | RHSA-2026:53646, RHSA-2026:53645 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-6.redhat_00012.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus +1 | 2.0.5-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus-activation | 2.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.84.0-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.6.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-3.jre_redhat_00004.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava-failureaccess | 1.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.7.19-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.48-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate-search +6 | 7.2.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.4-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-metadata +5 | 16.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.132-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-plexus-utils | 3.6.1-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava | 3.1.12-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-5.redhat_00003.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.6-5.GA_redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-client-config | 1.0.1-4.Final_redhat_00002.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.1.4-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-10.GA_redhat_00017.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl +1 | 2.3.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el8-x86_64 | 2.3.0-1.Final.redhat.00001.1.el8eap | RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el9-x86_64 | 2.3.0-1.Final_redhat_00001.1.el9eap | RHSA-2026:18055 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.4-5.redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bouncycastle | 1.84-1.1 | openSUSE-SU-2026:10571-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | bouncycastle +6 | 1.70-4.amzn2023.0.7 | ALAS2023-2026-1775 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi | 2.9.0-r0 | — |
| Wolfi rolling | apache-nifi-registry +1 | 2.9.0-r1 | — |
| Wolfi rolling | apache-pulsar-4.2 | 4.2.1-r0 | — |
| Wolfi rolling | druid | 36.0.0-r15 | — |
| Wolfi rolling | gradle-stage0 +4 | No fix yet | — |
| Wolfi rolling | jenkins-2-openjdk-21 +1 | 2.560-r0 | — |
| Wolfi rolling | jruby-10.1 | 10.1.0.0-r1 | — |
| Wolfi rolling | jruby-9.4 | 9.4.14.0-r5 | — |
| Wolfi rolling | keycloak-26.6 +1 | 26.6.1-r4 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r31 | — |
| Wolfi rolling | logstash-9.3 +1 | 9.3.5-r0 | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.1-r3 | — |
| Wolfi rolling | sonarqube | 26.7.0.124771-r0 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1.2-r0 | — |
| Wolfi rolling | wildfly-openjdk-17 +1 | 39.0.1-r5 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bcpkix-debug-jdk14 | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
| Maven | org.bouncycastle:bcpkix-debug-jdk15to18 | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
| Maven | org.bouncycastle:bcpkix-debug-jdk18on | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
| Maven | org.bouncycastle:bcpkix-jdk14 | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
| Maven | org.bouncycastle:bcpkix-jdk15on | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
| Maven | org.bouncycastle:bcpkix-jdk15to18 | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
| Maven | org.bouncycastle:bcpkix-jdk18on | >= 1.49, < 1.84 | 1.84 | GHSA-wg6q-6289-32hp |
Advisories 14
- WID-SEC-2026-1129 Bouncy Castle BC-JAVA: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- RHSA-2026:76130 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76129 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76128 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53646 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53645 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:53644 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18055 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18054 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2444 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2026
- WID-SEC-2026-1687 IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Sep 1, 2026
- ALAS2023-2026-1775 Moderate: bouncycastle security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- openSUSE-SU-2026:10571-1 bouncycastle-1.84-1.1 on GA media SUSE / openSUSE Security Updates · Apr 19, 2026