Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-59649 Denial of Service via Unbounded OpenPGP User-Attribute Subpacket in Bouncy Castle https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-59649
Post summary
The text announces a CVE 2026‑59649 describing a denial‑of‑service vulnerability in Bouncy Castle due to an unbounded OpenPGP user‑attribute subpacket, but does not disclose PoC, exploitation, or patch information.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bouncycastle | bc-java | - | - | - |
| App | bouncycastle | bcpg-fips | - | - | - |
| App | bouncycastle | bouncy_castle_for_java_lts | - | - | - |