Vulnerability in Bouncy Castle for Java Affects Multiple Versions
CVE-2026-13506

8.7HIGH

Key Information:

Vendor

Legion Of The Bouncy Castle Inc.

Status
Bc-java
Bc-lts-java
Bc-fja
Vendor
CVE Published:
3 August 2026

What is CVE-2026-13506?

A vulnerability exists in Bouncy Castle for Java prior to version 1.85, where Lazy ASN.1 sequence forcing improperly handles nesting-depth guarding. This flaw can potentially lead to unexpected behavior during ASN.1 sequence processing, impacting how data structures are interpreted. The issue is present in various versions, including Bouncy Castle for Java LTS prior to 2.73.12 and Bouncy Castle for Java FIPS in specific earlier series. Users are advised to update to the latest versions to safeguard against potential exploits.

Affected Version(s)

BC-FJA all 1.0.0 < 1.0.2.7

BC-FJA all 2.0.0 < 2.0.2

BC-FJA all 2.1.0 < 2.1.3

References

https://github.com/bcgit/bc-java/wiki/CVE-2026-13506
vendor-advisory
https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa29...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yt
Alex Gaynor in collaboration with Claude and Anthropic Research
.