CVE catalog
CVE-2026-58063
In Bouncy Castle for Java before 1.85, BCFKS keystore…
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.42% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debiansid | bouncycastle | 1.86-1 | FixedDistribution-reported fixed boundary | [CVE-2026-58063] |
| Debiansid | bouncycastle | 1.86.2-1 | Fixed | [CVE-2026-58063] |
| Debianforky | bouncycastle | 1.86-1 | FixedDistribution-reported fixed boundary | [CVE-2026-58063] |
Showing 3 fix observations. All 7 observations, including unknown and conflicting reports, are available below.
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debianbookworm | bouncycastle | Not reported | AffectedDistribution reports no fix | [CVE-2026-58063] |
| Debianbookworm | bouncycastle | 1.72-2 | Affected | [CVE-2026-58063] |
| Debianforky | bouncycastle | 1.86-1 | FixedDistribution-reported fixed boundary | [CVE-2026-58063] |
| Debiansid | bouncycastle | 1.86-1 | FixedDistribution-reported fixed boundary | [CVE-2026-58063] |
| Debiansid | bouncycastle | 1.86.2-1 | Fixed | [CVE-2026-58063] |
| Debiantrixie | bouncycastle | Not reported | AffectedDistribution reports no fix | [CVE-2026-58063] |
| Debiantrixie | bouncycastle | 1.80-3 | Affected | [CVE-2026-58063] |
Original provider fields
{
"package_releases": [
{
"name": "bouncycastle",
"status": "fixed",
"release": "sid",
"version": "1.86.2-1"
},
{
"name": "bouncycastle",
"status": "fixed",
"release": "forky",
"version": "1.86-1"
},
{
"name": "bouncycastle",
"status": "vulnerable",
"release": "trixie",
"version": "1.80-3"
},
{
"name": "bouncycastle",
"status": "vulnerable",
"release": "bookworm",
"version": "1.72-2"
}
],
"fixed_versions": [
{
"bug": 1143536,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "1.86-1"
},
{
"bug": 1143536,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "1.86-1"
},
{
"bug": 1143536,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": 1143536,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "bc-java",
"ranges": [
{
"fixed": "1.85",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58063",
"fixed_version": "1.85",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-58063",
"provider_updated_at": "2026-09-02T14:34:30.587"
},
{
"name": "bouncy_castle_for_java_lts",
"ranges": [
{
"fixed": "",
"introduced": "",
"last_affected": "2.73.11",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58063",
"fixed_version": "",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-58063",
"provider_updated_at": "2026-09-02T14:34:30.587"
},
{
"name": "fips_java_api",
"ranges": [
{
"fixed": "2.1.3",
"introduced": "2.1.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58063",
"fixed_version": "2.1.3",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-58063",
"provider_updated_at": "2026-09-02T14:34:30.587"
}
]
}OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libbcjmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcpg-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcpkix-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcprov-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbctls-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcutil-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.72-2· all · bookwormUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
[Debian 13 (Trixie)]
- [libbcjmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcpg-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcpkix-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcprov-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbctls-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
- [libbcutil-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
1.80-3· all · trixieUnknown · Fixed:
1.86-1Version impact unknown
nvd · bouncycastle · debian · bookworm; pypi · bouncycastle · debian · 12; pypi · bouncycastle · debian · 13; pypi · bouncycastle · debian · 14
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11445-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-58063]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-58063]
- [https://security-tracker.debian.org/tracker/CVE-2026-58063]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58063.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2622.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]