CVE-2026-59638CWE-297

CVE-2026-59638

Medium · published August 3, 2026

CVSS v3.1

6.5

EPSS

Percentile

26.8

In the wild

Unconfirmed

What it is

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00345 · 26.8th percentile
Weakness: CWE-297 · Improper Validation of Certificate with Host Mismatch
Published: 2026-08-03T05:16Z

Affected products (5)

Product	Versions	Fixed in
bouncycastle/bc-java	< 1.85	1.85
bouncycastle/bctls-fips	≥ 1.0.0, < 1.0.24	1.0.24
bouncycastle/bctls-fips	≥ 2.0.19, < 2.0.24	2.0.24
bouncycastle/bctls-fips	≥ 2.1.20, < 2.1.24	2.1.24
bouncycastle/bouncy_castle_for_java_lts	≤ 2.73.11	—

References (3)

https://github.com/bcgit/bc-java/commit/5ac55351cd1a8a7184d41c96a7ee87df0770240a · 91579145-5d7b-4cc5-b925-a0262ff19630 https://github.com/bcgit/bc-java/commit/799bd15320a6310a447863638aa3df64acef829b · 91579145-5d7b-4cc5-b925-a0262ff19630 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059638 · 91579145-5d7b-4cc5-b925-a0262ff19630

EPSS history

Timeline

03 AUG 00:57Z
JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
cvelistv5