{"id":"CVE-2026-59647","title":"In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count","summary":"In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X …","severity":"high","cwe":["CWE-770","CWE-606"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59647","references":[{"url":"https://github.com/bcgit/bc-java/commit/c99d6427d6818d04165b07b45dfda96f2b384c53","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59647","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59647.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59647"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510207"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59647"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59647"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.958Z","epss":0.00275,"epssPercentile":0.20103,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-59647","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Single Sign-On 7 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59647.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201839,"id":"CVE-2026-59647","ts":1789399743130,"field":"cvss","old":null,"new":"7.5"},{"seq":201838,"id":"CVE-2026-59647","ts":1789399743130,"field":"severity","old":"none","new":"high"},{"seq":200569,"id":"CVE-2026-59647","ts":1789397412220,"field":"cvss","old":"7.5","new":null},{"seq":200568,"id":"CVE-2026-59647","ts":1789397412220,"field":"severity","old":"high","new":"none"},{"seq":198486,"id":"CVE-2026-59647","ts":1789392001490,"field":"cvss","old":null,"new":"7.5"},{"seq":198485,"id":"CVE-2026-59647","ts":1789392001490,"field":"severity","old":"none","new":"high"},{"seq":196279,"id":"CVE-2026-59647","ts":1789383612102,"field":"cvss","old":"7.5","new":null},{"seq":196278,"id":"CVE-2026-59647","ts":1789383612102,"field":"severity","old":"high","new":"none"},{"seq":195208,"id":"CVE-2026-59647","ts":1789380497200,"field":"cvss","old":null,"new":"7.5"},{"seq":195207,"id":"CVE-2026-59647","ts":1789380497200,"field":"severity","old":"none","new":"high"},{"seq":193995,"id":"CVE-2026-59647","ts":1789378551994,"field":"cvss","old":"7.5","new":null},{"seq":193994,"id":"CVE-2026-59647","ts":1789378551994,"field":"severity","old":"high","new":"none"},{"seq":192782,"id":"CVE-2026-59647","ts":1789376426115,"field":"cvss","old":null,"new":"7.5"},{"seq":192781,"id":"CVE-2026-59647","ts":1789376426115,"field":"severity","old":"none","new":"high"},{"seq":191569,"id":"CVE-2026-59647","ts":1789373454911,"field":"cvss","old":"7.5","new":null},{"seq":191568,"id":"CVE-2026-59647","ts":1789373454911,"field":"severity","old":"high","new":"none"},{"seq":190354,"id":"CVE-2026-59647","ts":1789369346668,"field":"cvss","old":null,"new":"7.5"},{"seq":190353,"id":"CVE-2026-59647","ts":1789369346668,"field":"severity","old":"none","new":"high"},{"seq":189141,"id":"CVE-2026-59647","ts":1789368282988,"field":"cvss","old":"7.5","new":null},{"seq":189140,"id":"CVE-2026-59647","ts":1789368282988,"field":"severity","old":"high","new":"none"},{"seq":187924,"id":"CVE-2026-59647","ts":1789365162019,"field":"cvss","old":null,"new":"7.5"},{"seq":187923,"id":"CVE-2026-59647","ts":1789365162019,"field":"severity","old":"none","new":"high"},{"seq":186711,"id":"CVE-2026-59647","ts":1789363306414,"field":"cvss","old":"7.5","new":null},{"seq":186710,"id":"CVE-2026-59647","ts":1789363306414,"field":"severity","old":"high","new":"none"},{"seq":185497,"id":"CVE-2026-59647","ts":1789361123072,"field":"cvss","old":null,"new":"7.5"},{"seq":185496,"id":"CVE-2026-59647","ts":1789361123072,"field":"severity","old":"none","new":"high"},{"seq":184284,"id":"CVE-2026-59647","ts":1789358181416,"field":"cvss","old":"7.5","new":null},{"seq":184283,"id":"CVE-2026-59647","ts":1789358181416,"field":"severity","old":"high","new":"none"},{"seq":182535,"id":"CVE-2026-59647","ts":1789354238655,"field":"cvss","old":null,"new":"7.5"},{"seq":182534,"id":"CVE-2026-59647","ts":1789354238655,"field":"severity","old":"none","new":"high"},{"seq":181328,"id":"CVE-2026-59647","ts":1789353154270,"field":"cvss","old":"7.5","new":null},{"seq":181327,"id":"CVE-2026-59647","ts":1789353154270,"field":"severity","old":"high","new":"none"},{"seq":180121,"id":"CVE-2026-59647","ts":1789350187409,"field":"cvss","old":null,"new":"7.5"},{"seq":180120,"id":"CVE-2026-59647","ts":1789350187409,"field":"severity","old":"none","new":"high"},{"seq":178914,"id":"CVE-2026-59647","ts":1789348122986,"field":"cvss","old":"7.5","new":null},{"seq":178913,"id":"CVE-2026-59647","ts":1789348122986,"field":"severity","old":"high","new":"none"},{"seq":177707,"id":"CVE-2026-59647","ts":1789346293685,"field":"cvss","old":null,"new":"7.5"},{"seq":177706,"id":"CVE-2026-59647","ts":1789346293685,"field":"severity","old":"none","new":"high"},{"seq":176500,"id":"CVE-2026-59647","ts":1789343045117,"field":"cvss","old":"7.5","new":null},{"seq":176499,"id":"CVE-2026-59647","ts":1789343045117,"field":"severity","old":"high","new":"none"},{"seq":174617,"id":"CVE-2026-59647","ts":1789334801287,"field":"cvss","old":null,"new":"7.5"},{"seq":174616,"id":"CVE-2026-59647","ts":1789334801287,"field":"severity","old":"none","new":"high"},{"seq":173412,"id":"CVE-2026-59647","ts":1789333531234,"field":"cvss","old":"7.5","new":null},{"seq":173411,"id":"CVE-2026-59647","ts":1789333531234,"field":"severity","old":"high","new":"none"},{"seq":172226,"id":"CVE-2026-59647","ts":1789331030713,"field":"cvss","old":null,"new":"7.5"},{"seq":172225,"id":"CVE-2026-59647","ts":1789331030713,"field":"severity","old":"none","new":"high"},{"seq":171040,"id":"CVE-2026-59647","ts":1789328646575,"field":"cvss","old":"7.5","new":null},{"seq":171039,"id":"CVE-2026-59647","ts":1789328646575,"field":"severity","old":"high","new":"none"},{"seq":169835,"id":"CVE-2026-59647","ts":1789327070055,"field":"cvss","old":null,"new":"7.5"},{"seq":169834,"id":"CVE-2026-59647","ts":1789327070055,"field":"severity","old":"none","new":"high"}]}