{"id":"CVE-2026-59645","title":"In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema","summary":"In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcu…","severity":"high","cwe":["CWE-674","CWE-835"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59645","references":[{"url":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59645","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59645.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59645"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510189"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59645"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59645"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.900Z","epss":0.0031,"epssPercentile":0.24001,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-59645","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Single Sign-On 7 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59645.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201837,"id":"CVE-2026-59645","ts":1789399743115,"field":"cvss","old":null,"new":"7.5"},{"seq":201836,"id":"CVE-2026-59645","ts":1789399743115,"field":"severity","old":"none","new":"high"},{"seq":200567,"id":"CVE-2026-59645","ts":1789397412207,"field":"cvss","old":"7.5","new":null},{"seq":200566,"id":"CVE-2026-59645","ts":1789397412207,"field":"severity","old":"high","new":"none"},{"seq":198484,"id":"CVE-2026-59645","ts":1789392001477,"field":"cvss","old":null,"new":"7.5"},{"seq":198483,"id":"CVE-2026-59645","ts":1789392001477,"field":"severity","old":"none","new":"high"},{"seq":196277,"id":"CVE-2026-59645","ts":1789383612088,"field":"cvss","old":"7.5","new":null},{"seq":196276,"id":"CVE-2026-59645","ts":1789383612088,"field":"severity","old":"high","new":"none"},{"seq":195206,"id":"CVE-2026-59645","ts":1789380497188,"field":"cvss","old":null,"new":"7.5"},{"seq":195205,"id":"CVE-2026-59645","ts":1789380497188,"field":"severity","old":"none","new":"high"},{"seq":193993,"id":"CVE-2026-59645","ts":1789378551980,"field":"cvss","old":"7.5","new":null},{"seq":193992,"id":"CVE-2026-59645","ts":1789378551980,"field":"severity","old":"high","new":"none"},{"seq":192780,"id":"CVE-2026-59645","ts":1789376426102,"field":"cvss","old":null,"new":"7.5"},{"seq":192779,"id":"CVE-2026-59645","ts":1789376426102,"field":"severity","old":"none","new":"high"},{"seq":191567,"id":"CVE-2026-59645","ts":1789373454897,"field":"cvss","old":"7.5","new":null},{"seq":191566,"id":"CVE-2026-59645","ts":1789373454897,"field":"severity","old":"high","new":"none"},{"seq":190352,"id":"CVE-2026-59645","ts":1789369346375,"field":"cvss","old":null,"new":"7.5"},{"seq":190351,"id":"CVE-2026-59645","ts":1789369346375,"field":"severity","old":"none","new":"high"},{"seq":189139,"id":"CVE-2026-59645","ts":1789368282975,"field":"cvss","old":"7.5","new":null},{"seq":189138,"id":"CVE-2026-59645","ts":1789368282975,"field":"severity","old":"high","new":"none"},{"seq":187922,"id":"CVE-2026-59645","ts":1789365162006,"field":"cvss","old":null,"new":"7.5"},{"seq":187921,"id":"CVE-2026-59645","ts":1789365162006,"field":"severity","old":"none","new":"high"},{"seq":186709,"id":"CVE-2026-59645","ts":1789363306401,"field":"cvss","old":"7.5","new":null},{"seq":186708,"id":"CVE-2026-59645","ts":1789363306401,"field":"severity","old":"high","new":"none"},{"seq":185495,"id":"CVE-2026-59645","ts":1789361123060,"field":"cvss","old":null,"new":"7.5"},{"seq":185494,"id":"CVE-2026-59645","ts":1789361123060,"field":"severity","old":"none","new":"high"},{"seq":184282,"id":"CVE-2026-59645","ts":1789358181402,"field":"cvss","old":"7.5","new":null},{"seq":184281,"id":"CVE-2026-59645","ts":1789358181402,"field":"severity","old":"high","new":"none"},{"seq":182533,"id":"CVE-2026-59645","ts":1789354238636,"field":"cvss","old":null,"new":"7.5"},{"seq":182532,"id":"CVE-2026-59645","ts":1789354238636,"field":"severity","old":"none","new":"high"},{"seq":181326,"id":"CVE-2026-59645","ts":1789353154235,"field":"cvss","old":"7.5","new":null},{"seq":181325,"id":"CVE-2026-59645","ts":1789353154235,"field":"severity","old":"high","new":"none"},{"seq":180119,"id":"CVE-2026-59645","ts":1789350187394,"field":"cvss","old":null,"new":"7.5"},{"seq":180118,"id":"CVE-2026-59645","ts":1789350187394,"field":"severity","old":"none","new":"high"},{"seq":178912,"id":"CVE-2026-59645","ts":1789348122972,"field":"cvss","old":"7.5","new":null},{"seq":178911,"id":"CVE-2026-59645","ts":1789348122972,"field":"severity","old":"high","new":"none"},{"seq":177705,"id":"CVE-2026-59645","ts":1789346293670,"field":"cvss","old":null,"new":"7.5"},{"seq":177704,"id":"CVE-2026-59645","ts":1789346293670,"field":"severity","old":"none","new":"high"},{"seq":176498,"id":"CVE-2026-59645","ts":1789343044810,"field":"cvss","old":"7.5","new":null},{"seq":176497,"id":"CVE-2026-59645","ts":1789343044810,"field":"severity","old":"high","new":"none"},{"seq":174615,"id":"CVE-2026-59645","ts":1789334801274,"field":"cvss","old":null,"new":"7.5"},{"seq":174614,"id":"CVE-2026-59645","ts":1789334801274,"field":"severity","old":"none","new":"high"},{"seq":173410,"id":"CVE-2026-59645","ts":1789333530909,"field":"cvss","old":"7.5","new":null},{"seq":173409,"id":"CVE-2026-59645","ts":1789333530909,"field":"severity","old":"high","new":"none"},{"seq":172224,"id":"CVE-2026-59645","ts":1789331030700,"field":"cvss","old":null,"new":"7.5"},{"seq":172223,"id":"CVE-2026-59645","ts":1789331030700,"field":"severity","old":"none","new":"high"},{"seq":171038,"id":"CVE-2026-59645","ts":1789328646559,"field":"cvss","old":"7.5","new":null},{"seq":171037,"id":"CVE-2026-59645","ts":1789328646559,"field":"severity","old":"high","new":"none"},{"seq":169833,"id":"CVE-2026-59645","ts":1789327070042,"field":"cvss","old":null,"new":"7.5"},{"seq":169832,"id":"CVE-2026-59645","ts":1789327070042,"field":"severity","old":"none","new":"high"}]}