CVE catalog

CVE-2026-17507

Severity: High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Published: Oct 1, 2026, 10:00:00 PM UTC
Updated: Oct 2, 2026, 8:17:01 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.42% · Oct 25, 2026

In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an unprotected PrivateMessage could then drive LeafIndex.directPath through NodeIndex.parent() arithmetic that never reaches the tree root, growing the resulting node list without bound until the JVM exhausted its heap. A single small message from any current group member could therefore deny service to every other member of the group. Both comparisons now interpret the value as unsigned via Integer.toUnsignedLong, rejecting an out-of-range sender however it was encoded; well-formed leaf indices are unaffected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	bouncycastle	sid	`1.86.2-1`	fixed
Debian	bouncycastle	forky	`1.86-1`	fixed
Debian	bouncycastle	trixie	`1.80-3`	vulnerable
Debian	bouncycastle	bookworm	`1.72-2`	vulnerable
Cpe	bc-java	Not reported	`1.86`	fixed
Opensuse	bouncycastle	tumbleweed	`1.86-1.1`	fixed
Suse	bouncycastle	linux enterprise module for development tools 15 sp7	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise high performance computing 15 sp4-espos	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise high performance computing 15 sp4-ltss	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise high performance computing 15 sp5-espos	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise high performance computing 15 sp5-ltss	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise server 15 sp4-ltss	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise server 15 sp5-ltss	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise server 15 sp6-ltss	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise server for sap applications 15 sp4	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise server for sap applications 15 sp5	`1.86-150200.3.41.1`	fixed
Suse	bouncycastle	linux enterprise server for sap applications 15 sp6	`1.86-150200.3.41.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	bouncycastle	source	sid	`1.86-1`	not yet assigned	Not reported	Not reported
Debian	bouncycastle	source	forky	`1.86-1`	not yet assigned	Not reported	Not reported
Debian	bouncycastle	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	bouncycastle	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	bc-java	cpe	Not reported	`1.86`	Not reported	NVD-CVE-2026-17507	Not reported
Opensuse	bouncycastle	rpm	tumbleweed	`1.86-1.1`	Not reported	OPENSUSE-SU-2026:12090-1	Not reported
Suse	bouncycastle	rpm	linux enterprise module for development tools 15 sp7	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise high performance computing 15 sp4-espos	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise high performance computing 15 sp4-ltss	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise high performance computing 15 sp5-espos	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise high performance computing 15 sp5-ltss	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise server 15 sp4-ltss	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise server 15 sp5-ltss	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise server 15 sp6-ltss	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise server for sap applications 15 sp4	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise server for sap applications 15 sp5	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported
Suse	bouncycastle	rpm	linux enterprise server for sap applications 15 sp6	`1.86-150200.3.41.1`	Not reported	SUSE-SU-2026:4797-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libbcjmail-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
[libbcmail-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
[libbcpg-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
[libbcpkix-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
[libbcprov-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
[libbctls-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
[libbcutil-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm
- 1.72-2 · all · bookworm
  Affected
  nvd · bouncycastle · debian · bookworm

[openSUSE Tumbleweed]

[bouncycastle]Affected
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Affected · Fixed: 1.86-1.1
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-javadoc]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-jmail]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-mail]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-pg]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-pkix]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-tls]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed
[bouncycastle-util]Unknown
Source package: [bouncycastle]
Details (1)
- 1.85-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.86-1.1
  Version impact unknown
  nvd · bouncycastle · opensuse · tumbleweed

Observed: Oct 23, 2026, 7:46:40 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]