Post #4371192

Bouncy Castle Java 1.85 has been released. It includes fixes to various rather significant vulnerabilities and weaknesses. Some highlights: - CVE-2026-8763 - Name Constraints bypass via trailing dot in rfc822Name and URI. - CVE-2026-12803 - KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). - CVE-2026-12816 - IESEngine stream-mode MAC forgery via length-dependent KDF split. - CVE-2026-58061 - CCM-family modes write plaintext to caller buffer before tag check. - CVE-2026-58062 - Stapled OCSP response accepted without binding to the checked certificate. - CVE-2026-59639 - CMS verifySignatures returns true for SignedData with zero signers. https://www.bouncycastle.org/resources/new-release-bouncy-castle-java-1-85/ #infosec #cybersecurity