{"id":"CVE-2026-13505","title":"org.bouncycastle/bc-fips: Bouncy Castle for Java FIPS: Sensitive key material remains in memory due to delayed zeroisation (CVE-2026-13505)","summary":"A flaw was found in Bouncy Castle for Java FIPS (BC-FJA). Sensitive cryptographic key material, intended to be securely erased from memory (zeroised) upon garbage collection, may persist longer than expected. This occurs because the zerois…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-312","CWE-772"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","affected":["jboss_enterprise_application_platform_expansion_pack"],"patched":["org.bouncycastle:bc-fips 1.0.2.7","org.bouncycastle:bc-fips 2.0.2","org.bouncycastle:bc-fips 2.1.3"],"published":"2026-08-08","updated":"2026-09-24","sourceUpdated":"2026-09-24T00:06:16+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13505.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13505.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-13505"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512722"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13505"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13505"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"},{"url":"https://github.com/advisories/GHSA-98j2-6v39-78w8"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"epss":0.00253,"epssPercentile":0.17093,"aliases":["GHSA-98j2-6v39-78w8"],"ecosystem":"maven","ingestedAt":"2026-09-18T17:46:41.528Z","slug":"CVE-2026-13505","body":"## Overview\n\nA flaw was found in Bouncy Castle for Java FIPS (BC-FJA). Sensitive cryptographic key material, intended to be securely erased from memory (zeroised) upon garbage collection, may persist longer than expected. This occurs because the zeroisation process relies on a deprecated Java finalization mechanism, which can be delayed on Java 9 and later versions. Consequently, sensitive key material could remain resident in the system's memory, potentially leading to information disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat JBoss Enterprise Application Platform Expansion Pack · no fix planned: Red Hat JBoss Enterprise Application Platform Expansion Pack · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13505.json)\n\n**org.bouncycastle/bc-fips: Bouncy Castle for Java FIPS: Sensitive key material remains in memory due to delayed zeroisation** — rated Important by Red Hat. Released 2026-08-08, updated 2026-09-24.\n\nAffected:\n\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n\nNo fix planned:\n\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-13505)\n\nAffected packages:\n\n- `org.bouncycastle:bc-fips < 1.0.2.7`\n- `org.bouncycastle:bc-fips >= 2.0.0, < 2.0.2`\n- `org.bouncycastle:bc-fips >= 2.1.0, < 2.1.3`\n\nPatched in:\n\n- `org.bouncycastle:bc-fips 1.0.2.7`\n- `org.bouncycastle:bc-fips 2.0.2`\n- `org.bouncycastle:bc-fips 2.1.3`\n\nSource: https://github.com/advisories/GHSA-98j2-6v39-78w8","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":209988,"id":"CVE-2026-13505","ts":1790235632791,"field":"cvss","old":null,"new":"7.5"}]}