Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-59638 JSSE Hostname Verifier CN-Fallback Enabled by Default in Bouncy Castle for Java https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-59638
Post summary
The text announces a newly disclosed vulnerability (CVE‑2026‑59638) in Bouncy Castle, providing only the CVE identifier and a brief title, without details on exploitation or mitigation.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bouncycastle | bc-java | - | - | - |
| App | bouncycastle | bctls-fips | - | - | - |
| App | bouncycastle | bouncy_castle_for_java_lts | - | - | - |