---
id: CVE-2026-13505
title: >-
  org.bouncycastle/bc-fips: Bouncy Castle for Java FIPS: Sensitive key material
  remains in memory due to delayed zeroisation (CVE-2026-13505)
summary: >-
  A flaw was found in Bouncy Castle for Java FIPS (BC-FJA). Sensitive
  cryptographic key material, intended to be securely erased from memory
  (zeroised) upon garbage collection, may persist longer than expected. This
  occurs because the zerois…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-312
  - CWE-772
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
affected:
  - jboss_enterprise_application_platform_expansion_pack
patched:
  - 'org.bouncycastle:bc-fips 1.0.2.7'
  - 'org.bouncycastle:bc-fips 2.0.2'
  - 'org.bouncycastle:bc-fips 2.1.3'
published: '2026-08-08'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T00:06:16+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13505.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13505.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-13505'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512722'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-13505'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13505'
  - url: 'https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505'
  - url: 'https://github.com/advisories/GHSA-98j2-6v39-78w8'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
epss: 0.00253
epssPercentile: 0.15009
aliases:
  - GHSA-98j2-6v39-78w8
ecosystem: maven
ingestedAt: '2026-09-18T17:46:41.528Z'
---

## Overview

A flaw was found in Bouncy Castle for Java FIPS (BC-FJA). Sensitive cryptographic key material, intended to be securely erased from memory (zeroised) upon garbage collection, may persist longer than expected. This occurs because the zeroisation process relies on a deprecated Java finalization mechanism, which can be delayed on Java 9 and later versions. Consequently, sensitive key material could remain resident in the system's memory, potentially leading to information disclosure.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat JBoss Enterprise Application Platform Expansion Pack · no fix planned: Red Hat JBoss Enterprise Application Platform Expansion Pack · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13505.json)

**org.bouncycastle/bc-fips: Bouncy Castle for Java FIPS: Sensitive key material remains in memory due to delayed zeroisation** — rated Important by Red Hat. Released 2026-08-08, updated 2026-09-24.

Affected:

- Red Hat JBoss Enterprise Application Platform Expansion Pack

No fix planned:

- Red Hat JBoss Enterprise Application Platform Expansion Pack

## Remediation

Affected

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-13505)

Affected packages:

- `org.bouncycastle:bc-fips < 1.0.2.7`
- `org.bouncycastle:bc-fips >= 2.0.0, < 2.0.2`
- `org.bouncycastle:bc-fips >= 2.1.0, < 2.1.3`

Patched in:

- `org.bouncycastle:bc-fips 1.0.2.7`
- `org.bouncycastle:bc-fips 2.0.2`
- `org.bouncycastle:bc-fips 2.1.3`

Source: https://github.com/advisories/GHSA-98j2-6v39-78w8