CVE-2026-58060CWE-789

CVE-2026-58060

High · published August 3, 2026

CVSS v3.1

7.5

EPSS

Percentile

48.9

In the wild

Unconfirmed

What it is

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00616 · 48.9th percentile
Weakness: CWE-789 · Memory Allocation with Excessive Size Value
Published: 2026-08-03T07:16Z

Affected products (4)

Product	Versions	Fixed in
bouncycastle/bc-java	≥ 1.65, < 1.85	1.85
bouncycastle/bouncy_castle_for_java_lts	≤ 2.73.11	—
bouncycastle/fips_java_api	< 2.0.2	2.0.2
bouncycastle/fips_java_api	≥ 2.1.0, < 2.1.3	2.1.3

References (3)

https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276 · 91579145-5d7b-4cc5-b925-a0262ff19630 https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922 · 91579145-5d7b-4cc5-b925-a0262ff19630 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058060 · 91579145-5d7b-4cc5-b925-a0262ff19630

EPSS history

Timeline

03 AUG 02:37Z
HSS public-key level count unbounded, enabling huge allocation on verify
cvelistv5