{"id":"CVE-2026-59649","title":"In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory","summary":"In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1…","severity":"high","cwe":["CWE-789","CWE-770"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59649","references":[{"url":"https://github.com/bcgit/bc-java/commit/a43c40dc12c3e1c6cbd03c83fe30aaec4029b824","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59649","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59649.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59649"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510195"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59649"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59649"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:08.015Z","epss":0.0031,"epssPercentile":0.24,"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","affected":["openshift_developer_tools_and_services","build_of_apache_camel_4_for_quarkus 3","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform 8","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-59649","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat JBoss Enterprise Application Platform 8, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59649.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201841,"id":"CVE-2026-59649","ts":1789399743145,"field":"cvss","old":null,"new":"7.5"},{"seq":201840,"id":"CVE-2026-59649","ts":1789399743145,"field":"severity","old":"none","new":"high"},{"seq":200571,"id":"CVE-2026-59649","ts":1789397412234,"field":"cvss","old":"7.5","new":null},{"seq":200570,"id":"CVE-2026-59649","ts":1789397412234,"field":"severity","old":"high","new":"none"},{"seq":198488,"id":"CVE-2026-59649","ts":1789392001504,"field":"cvss","old":null,"new":"7.5"},{"seq":198487,"id":"CVE-2026-59649","ts":1789392001504,"field":"severity","old":"none","new":"high"},{"seq":196281,"id":"CVE-2026-59649","ts":1789383612115,"field":"cvss","old":"7.5","new":null},{"seq":196280,"id":"CVE-2026-59649","ts":1789383612115,"field":"severity","old":"high","new":"none"},{"seq":195210,"id":"CVE-2026-59649","ts":1789380497212,"field":"cvss","old":null,"new":"7.5"},{"seq":195209,"id":"CVE-2026-59649","ts":1789380497212,"field":"severity","old":"none","new":"high"},{"seq":193997,"id":"CVE-2026-59649","ts":1789378552008,"field":"cvss","old":"7.5","new":null},{"seq":193996,"id":"CVE-2026-59649","ts":1789378552008,"field":"severity","old":"high","new":"none"},{"seq":192784,"id":"CVE-2026-59649","ts":1789376426127,"field":"cvss","old":null,"new":"7.5"},{"seq":192783,"id":"CVE-2026-59649","ts":1789376426127,"field":"severity","old":"none","new":"high"},{"seq":191571,"id":"CVE-2026-59649","ts":1789373454925,"field":"cvss","old":"7.5","new":null},{"seq":191570,"id":"CVE-2026-59649","ts":1789373454925,"field":"severity","old":"high","new":"none"},{"seq":190356,"id":"CVE-2026-59649","ts":1789369346962,"field":"cvss","old":null,"new":"7.5"},{"seq":190355,"id":"CVE-2026-59649","ts":1789369346962,"field":"severity","old":"none","new":"high"},{"seq":189143,"id":"CVE-2026-59649","ts":1789368283002,"field":"cvss","old":"7.5","new":null},{"seq":189142,"id":"CVE-2026-59649","ts":1789368283002,"field":"severity","old":"high","new":"none"},{"seq":187926,"id":"CVE-2026-59649","ts":1789365162032,"field":"cvss","old":null,"new":"7.5"},{"seq":187925,"id":"CVE-2026-59649","ts":1789365162032,"field":"severity","old":"none","new":"high"},{"seq":186713,"id":"CVE-2026-59649","ts":1789363306428,"field":"cvss","old":"7.5","new":null},{"seq":186712,"id":"CVE-2026-59649","ts":1789363306428,"field":"severity","old":"high","new":"none"},{"seq":185499,"id":"CVE-2026-59649","ts":1789361123085,"field":"cvss","old":null,"new":"7.5"},{"seq":185498,"id":"CVE-2026-59649","ts":1789361123085,"field":"severity","old":"none","new":"high"},{"seq":184286,"id":"CVE-2026-59649","ts":1789358181429,"field":"cvss","old":"7.5","new":null},{"seq":184285,"id":"CVE-2026-59649","ts":1789358181429,"field":"severity","old":"high","new":"none"},{"seq":182537,"id":"CVE-2026-59649","ts":1789354238670,"field":"cvss","old":null,"new":"7.5"},{"seq":182536,"id":"CVE-2026-59649","ts":1789354238670,"field":"severity","old":"none","new":"high"},{"seq":181330,"id":"CVE-2026-59649","ts":1789353154322,"field":"cvss","old":"7.5","new":null},{"seq":181329,"id":"CVE-2026-59649","ts":1789353154322,"field":"severity","old":"high","new":"none"},{"seq":180123,"id":"CVE-2026-59649","ts":1789350187424,"field":"cvss","old":null,"new":"7.5"},{"seq":180122,"id":"CVE-2026-59649","ts":1789350187424,"field":"severity","old":"none","new":"high"},{"seq":178916,"id":"CVE-2026-59649","ts":1789348122999,"field":"cvss","old":"7.5","new":null},{"seq":178915,"id":"CVE-2026-59649","ts":1789348122999,"field":"severity","old":"high","new":"none"},{"seq":177709,"id":"CVE-2026-59649","ts":1789346293699,"field":"cvss","old":null,"new":"7.5"},{"seq":177708,"id":"CVE-2026-59649","ts":1789346293699,"field":"severity","old":"none","new":"high"},{"seq":176502,"id":"CVE-2026-59649","ts":1789343045433,"field":"cvss","old":"7.5","new":null},{"seq":176501,"id":"CVE-2026-59649","ts":1789343045433,"field":"severity","old":"high","new":"none"},{"seq":174619,"id":"CVE-2026-59649","ts":1789334801300,"field":"cvss","old":null,"new":"7.5"},{"seq":174618,"id":"CVE-2026-59649","ts":1789334801300,"field":"severity","old":"none","new":"high"},{"seq":173414,"id":"CVE-2026-59649","ts":1789333531561,"field":"cvss","old":"7.5","new":null},{"seq":173413,"id":"CVE-2026-59649","ts":1789333531561,"field":"severity","old":"high","new":"none"},{"seq":172228,"id":"CVE-2026-59649","ts":1789331030726,"field":"cvss","old":null,"new":"7.5"},{"seq":172227,"id":"CVE-2026-59649","ts":1789331030726,"field":"severity","old":"none","new":"high"},{"seq":171042,"id":"CVE-2026-59649","ts":1789328646591,"field":"cvss","old":"7.5","new":null},{"seq":171041,"id":"CVE-2026-59649","ts":1789328646591,"field":"severity","old":"high","new":"none"},{"seq":169837,"id":"CVE-2026-59649","ts":1789327070067,"field":"cvss","old":null,"new":"7.5"},{"seq":169836,"id":"CVE-2026-59649","ts":1789327070067,"field":"severity","old":"none","new":"high"}]}