What’s Vulnerable › Products

Legion of the Bouncy Castle Inc. BCPKIX-FIPS vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Legion of the Bouncy Castle Inc. BCPKIX-FIPS version is affected

Latest Legion of the Bouncy Castle Inc. BCPKIX-FIPS vulnerabilities

• CVE-2026-12802 — CMS AuthEnvelopedData fails to enforce tag-length on decryption (CVSS 7.5)
• CVE-2026-59647 — CRMF/CMP password-MAC honours unbounded iteration count (CVSS 5.3)
• CVE-2026-59642 — CMS AuthenticatedData content not bound to MAC when authAttrs present (CVSS 7.5)
• CVE-2026-59639 — CMS verifySignatures returns true for SignedData with zero signers (CVSS 7.5)
• CVE-2026-15055 — PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (CVSS 8.2)
• CVE-2026-5588 — PKIX draft CompositeVerifier accepts empty signature sequence as valid. (CVSS 7.5)