Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2026-59650

kritisch

CVE-2026-59650

bouncycastle: Bouncy Castle for Java: Cryptographic key compromise due to unvalidated Diffie-Hellman peer value

Veröffentlicht Geändert CWE 20
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), Amazon (hoch).

Beschreibung

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
amazon linux 2023bouncycastle, bouncycastle-javadoc, bouncycastle-mail und 4 weitere1.70-4.amzn2023.0.8
chainguardkeycloak-26.6, keycloak-26.726.6.7-r1 und 1 weitere
debian 11bouncycastlekein Fix angegeben
debian 12bouncycastlekein Fix angegeben
debian 13bouncycastlekein Fix angegeben
debian 14bouncycastle1.86-1
echobouncycastlekein Fix angegeben
rapidfort amazon linux 2023bouncycastle, bouncycastle-javadoc, bouncycastle-mail und 4 weitere1.70-4.amzn2023.0.8
rapidfort debian 12bouncycastle0:1.86-1
rapidfort debian 13bouncycastle0:1.86-1
Red Hatbcprov-jdk15on, bcprov-jdk18on, candlepin und 1 weiterekein Fix angegeben
seal maven::Seal Security Databaseorg.bouncycastle:bcprov-jdk18on, seal.sp1.org.bouncycastle:bcprov-jdk18on, seal.sp2.org.bouncycastle:bcprov-jdk18on1.82+sp3p3, 1.84+sp2p2 und 2 weitere
Alle 31 Einträge aus 13 Quellen zeigen
QuellePaketBehoben in
amazon linux 2023bouncycastle1.70-4.amzn2023.0.8
amazon linux 2023bouncycastle-javadoc1.70-4.amzn2023.0.8
amazon linux 2023bouncycastle-mail1.70-4.amzn2023.0.8
amazon linux 2023bouncycastle-pg1.70-4.amzn2023.0.8
amazon linux 2023bouncycastle-pkix1.70-4.amzn2023.0.8
amazon linux 2023bouncycastle-tls1.70-4.amzn2023.0.8
amazon linux 2023bouncycastle-util1.70-4.amzn2023.0.8
chainguardkeycloak-26.626.6.7-r1
chainguardkeycloak-26.726.7.4-r1
debian 11bouncycastlekein Fix angegeben
debian 12bouncycastlekein Fix angegeben
debian 13bouncycastlekein Fix angegeben
debian 14bouncycastle1.86-1
echobouncycastlekein Fix angegeben
rapidfort amazon linux 2023bouncycastle1.70-4.amzn2023.0.8
rapidfort amazon linux 2023bouncycastle-javadoc1.70-4.amzn2023.0.8
rapidfort amazon linux 2023bouncycastle-mail1.70-4.amzn2023.0.8
rapidfort amazon linux 2023bouncycastle-pg1.70-4.amzn2023.0.8
rapidfort amazon linux 2023bouncycastle-pkix1.70-4.amzn2023.0.8
rapidfort amazon linux 2023bouncycastle-tls1.70-4.amzn2023.0.8
rapidfort amazon linux 2023bouncycastle-util1.70-4.amzn2023.0.8
rapidfort debian 12bouncycastle0:1.86-1
rapidfort debian 13bouncycastle0:1.86-1
Red Hatbcprov-jdk15onkein Fix angegeben
Red Hatbcprov-jdk18onkein Fix angegeben
Red Hatcandlepinkein Fix angegeben
Red Hatcandlepin-selinuxkein Fix angegeben
seal maven::Seal Security Databaseorg.bouncycastle:bcprov-jdk18on1.82+sp3p3, 1.84+sp2p2
seal maven::Seal Security Databaseseal.sp1.org.bouncycastle:bcprov-jdk18on1.82+sp999, 1.84+sp999
seal maven::Seal Security Databaseseal.sp2.org.bouncycastle:bcprov-jdk18on1.82+sp999
wolfikeycloak-26.626.6.7-r1

Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.