Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-58060 Unbounded HSS Public-Key Level Count Denial of Service in Bouncy Castle for Java https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58060
Post summary
The post references CVE-2026-58060, noting a denial‑of‑service flaw in Bouncy Castle for Java, but provides no PoC, exploit code, or patch details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bouncycastle | bc-java | - | - | - |
| App | bouncycastle | bouncy_castle_for_java_lts | - | - | - |
| App | bouncycastle | fips_java_api | - | - | - |