Untrusted Length Allocation in Bouncy Castle for Java Affects Key Store Integrity
CVE-2026-12185

7.1HIGH

Key Information:

Vendor

Legion Of The Bouncy Castle Inc.

Status
Bc-java
Bc-lts-java
Vendor
CVE Published:
3 August 2026

What is CVE-2026-12185?

A vulnerability has been identified in Bouncy Castle for Java that allows for untrusted length allocations within the BKS/UBER keystore mechanism, occurring before the integrity check has been performed. This issue poses potential risks to the security of cryptographic operations, since it could allow an attacker to exploit this flaw, leading to possible unauthorized access or data corruption. Users are advised to update to the latest version to mitigate the associated risks.

Affected Version(s)

BC-JAVA all 0 < 1.85

BC-LTS-JAVA all 2.73.0 < 2.73.12

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2...
vendor-advisory
https://github.com/bcgit/bc-java/commit/7bbd7fe5f44132e5b...
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Gaynor in collaboration with Claude and Anthropic Research
.