by Kastro
Paper/Archive/CVE-2026-58062

CVE-2026-58062

Legion of the Bouncy Castle Inc. BC-JAVA — Stapled OCSP response accepted without binding to the checked certificate

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
34
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 30.3.303 × 206.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected

ProductAffectedFixed inSource
BC-JAVA1.66 – < 1.851.85CNA
BC-LTS-JAVA2.73.0 – < 2.73.122.73.12CNA
BC-FJA2.0.0 – < 2.0.22.0.2CNA
BC-FJA2.1.0 – < 2.1.32.1.3CNA

Scores by source

bcorg (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058062patchgithub.com/bcgit/bc-java/commit/add5f822660f3b2c29fd824e2f4095469c42a1c7