# Legion of the Bouncy Castle Inc. BC-FJA.

Every CVE that names Legion of the Bouncy Castle Inc. BC-FJA among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent](https://agentprime.io/advisories/CVE-2026-71888.md)
  `CVE-2026-71888` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-354
- [PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate](https://agentprime.io/advisories/CVE-2026-71889.md)
  `CVE-2026-71889` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Oct 2026 · Tags: Weak cryptography or TLS
- [CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys](https://agentprime.io/advisories/CVE-2026-71892.md)
  `CVE-2026-71892` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-697
- [OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check](https://agentprime.io/advisories/CVE-2026-85515.md)
  `CVE-2026-85515` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-345, CWE-354
- [Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points](https://agentprime.io/advisories/CVE-2026-17508.md)
  `CVE-2026-17508` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service
- [PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)](https://agentprime.io/advisories/CVE-2026-13586.md)
  `CVE-2026-13586` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [OpenPGP AEAD decryption skips final tag on chunk-aligned data](https://agentprime.io/advisories/CVE-2026-12817.md)
  `CVE-2026-12817` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [CMS AuthEnvelopedData fails to enforce tag-length on decryption](https://agentprime.io/advisories/CVE-2026-12802.md)
  `CVE-2026-12802` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [Possible OOM from unbounded up-front allocation on a definite-length read](https://agentprime.io/advisories/CVE-2026-14682.md)
  `CVE-2026-14682` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [Quadratic-time escaping when stringifying X.500 distinguished names](https://agentprime.io/advisories/CVE-2026-58059.md)
  `CVE-2026-58059` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [HSS public-key level count unbounded, enabling huge allocation on verify](https://agentprime.io/advisories/CVE-2026-58060.md)
  `CVE-2026-58060` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [CCM-family modes write plaintext to caller buffer before tag check](https://agentprime.io/advisories/CVE-2026-58061.md)
  `CVE-2026-58061` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [Stapled OCSP response accepted without binding to the checked certificate](https://agentprime.io/advisories/CVE-2026-58062.md)
  `CVE-2026-58062` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [BCFKS keystore load honours unbounded KDF cost from untrusted file](https://agentprime.io/advisories/CVE-2026-58063.md)
  `CVE-2026-58063` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [JSSE hostname verifier CN-fallback enabled by default despite documented opt-in](https://agentprime.io/advisories/CVE-2026-59638.md)
  `CVE-2026-59638` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [CMS verifySignatures returns true for SignedData with zero signers](https://agentprime.io/advisories/CVE-2026-59639.md)
  `CVE-2026-59639` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [OpenPGP CFB quick-check oracle active on symmetric/session-key paths](https://agentprime.io/advisories/CVE-2026-59640.md)
  `CVE-2026-59640` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Information disclosure
- [S/MIME validator trusts signer-asserted signingTime for path validation](https://agentprime.io/advisories/CVE-2026-59641.md)
  `CVE-2026-59641` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-345
- [CMS AuthenticatedData content not bound to MAC when authAttrs present](https://agentprime.io/advisories/CVE-2026-59642.md)
  `CVE-2026-59642` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [OpenPGP inline-signature policy failures silently ignored](https://agentprime.io/advisories/CVE-2026-59643.md)
  `CVE-2026-59643` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 1 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [OER parser recurses without depth limit on self-referential IEEE 1609.2 schema](https://agentprime.io/advisories/CVE-2026-59645.md)
  `CVE-2026-59645` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [DTLS handshake reassembler allocates buffer from unchecked 24-bit length](https://agentprime.io/advisories/CVE-2026-59646.md)
  `CVE-2026-59646` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [CRMF/CMP password-MAC honours unbounded iteration count](https://agentprime.io/advisories/CVE-2026-59647.md)
  `CVE-2026-59647` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [OpenPGP Argon2 S2K honours attacker-chosen memory and passes](https://agentprime.io/advisories/CVE-2026-59648.md)
  `CVE-2026-59648` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [OpenPGP user-attribute subpacket length bounded only by JVM max memory](https://agentprime.io/advisories/CVE-2026-59649.md)
  `CVE-2026-59649` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service
- [PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input](https://agentprime.io/advisories/CVE-2026-15055.md)
  `CVE-2026-15055` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Denial of service

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=legion-of-the-bouncy-castle-inc-bc-fja>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/legion-of-the-bouncy-castle-inc-bc-fja/>. Everything for agents: <https://agentprime.io/llms.txt>.