Bouncy Castle Java 1.85 closes 32 CVEs in core crypto paths
The July release patches signature, AEAD, keystore, and certificate-validation flaws in a library embedded across countless JVM applications.
Bouncy Castle Java 1.85, released 28 July, fixes 32 CVEs across cryptographic verification, authenticated encryption, keystore loading, and certificate handling in one of the most widely deployed open-source cryptography stacks for the JVM.
The library underpins TLS, CMS, S/MIME, OpenPGP, and custom PKI code in large numbers of Java applications. Several of the fixed flaws break integrity or authentication rather than only availability. CMS signature verification could report success for SignedData with zero signers (CVE-2026-59639). RSA PKCS#1 verification skipped the last two hash bytes on a NULL-omitted path (CVE-2026-12860). CCM-family modes wrote plaintext into the caller buffer before the authentication tag was checked (CVE-2026-58061). Related AEAD constructions allowed cross-nonce or length-dependent MAC forgeries when associated data was absent or when key-derivation splits depended on attacker-controlled lengths (CVE-2026-12803, CVE-2026-12816).
OpenPGP was affected twice: AEAD decryption could skip the final tag on chunk-aligned ciphertext (CVE-2026-12817), and a CFB quick-check oracle remained live on symmetric and session-key paths (CVE-2026-59640). Name and certificate checks also failed open in places. Name constraints could be bypassed via a trailing dot in rfc822Name and URI forms (CVE-2026-8763). Stapled OCSP responses were accepted without binding to the certificate under check (CVE-2026-58062). The JSSE hostname verifier left CN-fallback on by default despite documentation that described it as opt-in (CVE-2026-59638).
A second cluster is denial of service from untrusted inputs. BKS/UBER, BCFKS, PKCS#12, and PKCS#8/PBES2 paths honoured attacker-supplied KDF costs or allocated from untrusted lengths before integrity checks. Similar unbounded or premature allocations appeared in MLS wire decoding, HSS public-key verification, ASN.1 definite-length reads, and lazy ASN.1 sequence handling that could reset nesting-depth guards. Escaping X.500 distinguished names was quadratic in input size.
The same release also advances post-quantum cryptography, PKI migration, electronic signatures, secure messaging, and blockchain support. Applications that embed Bouncy Castle should treat 1.85 as a priority upgrade given the breadth of the issues.