{"id":"CVE-2026-59651","title":"In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key","summary":"In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.","severity":"high","cwe":["CWE-326","CWE-1240"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59651","references":[{"url":"https://github.com/bcgit/bc-java/commit/faf5daa6e9b8460f862afc0af1cc0da365f7d4d2","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59651","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59651.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59651"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510188"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59651"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59651"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:08.072Z","epss":0.00163,"epssPercentile":0.05969,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","slug":"CVE-2026-59651","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Single Sign-On 7 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59651.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201843,"id":"CVE-2026-59651","ts":1789399743161,"field":"cvss","old":null,"new":"7.5"},{"seq":201842,"id":"CVE-2026-59651","ts":1789399743161,"field":"severity","old":"none","new":"high"},{"seq":200573,"id":"CVE-2026-59651","ts":1789397412248,"field":"cvss","old":"7.5","new":null},{"seq":200572,"id":"CVE-2026-59651","ts":1789397412248,"field":"severity","old":"high","new":"none"},{"seq":198490,"id":"CVE-2026-59651","ts":1789392001517,"field":"cvss","old":null,"new":"7.5"},{"seq":198489,"id":"CVE-2026-59651","ts":1789392001517,"field":"severity","old":"none","new":"high"},{"seq":196283,"id":"CVE-2026-59651","ts":1789383612129,"field":"cvss","old":"7.5","new":null},{"seq":196282,"id":"CVE-2026-59651","ts":1789383612129,"field":"severity","old":"high","new":"none"},{"seq":195212,"id":"CVE-2026-59651","ts":1789380497224,"field":"cvss","old":null,"new":"7.5"},{"seq":195211,"id":"CVE-2026-59651","ts":1789380497224,"field":"severity","old":"none","new":"high"},{"seq":193999,"id":"CVE-2026-59651","ts":1789378552023,"field":"cvss","old":"7.5","new":null},{"seq":193998,"id":"CVE-2026-59651","ts":1789378552023,"field":"severity","old":"high","new":"none"},{"seq":192786,"id":"CVE-2026-59651","ts":1789376426140,"field":"cvss","old":null,"new":"7.5"},{"seq":192785,"id":"CVE-2026-59651","ts":1789376426140,"field":"severity","old":"none","new":"high"},{"seq":191573,"id":"CVE-2026-59651","ts":1789373454938,"field":"cvss","old":"7.5","new":null},{"seq":191572,"id":"CVE-2026-59651","ts":1789373454938,"field":"severity","old":"high","new":"none"},{"seq":190358,"id":"CVE-2026-59651","ts":1789369347256,"field":"cvss","old":null,"new":"7.5"},{"seq":190357,"id":"CVE-2026-59651","ts":1789369347256,"field":"severity","old":"none","new":"high"},{"seq":189145,"id":"CVE-2026-59651","ts":1789368283016,"field":"cvss","old":"7.5","new":null},{"seq":189144,"id":"CVE-2026-59651","ts":1789368283016,"field":"severity","old":"high","new":"none"},{"seq":187928,"id":"CVE-2026-59651","ts":1789365162045,"field":"cvss","old":null,"new":"7.5"},{"seq":187927,"id":"CVE-2026-59651","ts":1789365162045,"field":"severity","old":"none","new":"high"},{"seq":186715,"id":"CVE-2026-59651","ts":1789363306441,"field":"cvss","old":"7.5","new":null},{"seq":186714,"id":"CVE-2026-59651","ts":1789363306441,"field":"severity","old":"high","new":"none"},{"seq":185501,"id":"CVE-2026-59651","ts":1789361123098,"field":"cvss","old":null,"new":"7.5"},{"seq":185500,"id":"CVE-2026-59651","ts":1789361123098,"field":"severity","old":"none","new":"high"},{"seq":184288,"id":"CVE-2026-59651","ts":1789358181442,"field":"cvss","old":"7.5","new":null},{"seq":184287,"id":"CVE-2026-59651","ts":1789358181442,"field":"severity","old":"high","new":"none"},{"seq":182539,"id":"CVE-2026-59651","ts":1789354238683,"field":"cvss","old":null,"new":"7.5"},{"seq":182538,"id":"CVE-2026-59651","ts":1789354238683,"field":"severity","old":"none","new":"high"},{"seq":181332,"id":"CVE-2026-59651","ts":1789353154526,"field":"cvss","old":"7.5","new":null},{"seq":181331,"id":"CVE-2026-59651","ts":1789353154526,"field":"severity","old":"high","new":"none"},{"seq":180125,"id":"CVE-2026-59651","ts":1789350187438,"field":"cvss","old":null,"new":"7.5"},{"seq":180124,"id":"CVE-2026-59651","ts":1789350187438,"field":"severity","old":"none","new":"high"},{"seq":178918,"id":"CVE-2026-59651","ts":1789348123013,"field":"cvss","old":"7.5","new":null},{"seq":178917,"id":"CVE-2026-59651","ts":1789348123013,"field":"severity","old":"high","new":"none"},{"seq":177711,"id":"CVE-2026-59651","ts":1789346293713,"field":"cvss","old":null,"new":"7.5"},{"seq":177710,"id":"CVE-2026-59651","ts":1789346293713,"field":"severity","old":"none","new":"high"},{"seq":176504,"id":"CVE-2026-59651","ts":1789343045749,"field":"cvss","old":"7.5","new":null},{"seq":176503,"id":"CVE-2026-59651","ts":1789343045749,"field":"severity","old":"high","new":"none"},{"seq":174621,"id":"CVE-2026-59651","ts":1789334801312,"field":"cvss","old":null,"new":"7.5"},{"seq":174620,"id":"CVE-2026-59651","ts":1789334801312,"field":"severity","old":"none","new":"high"},{"seq":173416,"id":"CVE-2026-59651","ts":1789333531887,"field":"cvss","old":"7.5","new":null},{"seq":173415,"id":"CVE-2026-59651","ts":1789333531887,"field":"severity","old":"high","new":"none"},{"seq":172230,"id":"CVE-2026-59651","ts":1789331030739,"field":"cvss","old":null,"new":"7.5"},{"seq":172229,"id":"CVE-2026-59651","ts":1789331030739,"field":"severity","old":"none","new":"high"},{"seq":171044,"id":"CVE-2026-59651","ts":1789328646607,"field":"cvss","old":"7.5","new":null},{"seq":171043,"id":"CVE-2026-59651","ts":1789328646607,"field":"severity","old":"high","new":"none"},{"seq":169839,"id":"CVE-2026-59651","ts":1789327070079,"field":"cvss","old":null,"new":"7.5"},{"seq":169838,"id":"CVE-2026-59651","ts":1789327070079,"field":"severity","old":"none","new":"high"}]}