CLSA-2026-1794215677: TuxCare security update for org.bouncycastle (4 CVEs)

Q: Which packages should be checked for this update?

Check the TuxCare org.bouncycastle packages bcprov-jdk14 and bcprov-jdk15. The advisory states that three org.bouncycastle packages were rebuilt, but only these two package names are identified in the provided software data.

Q: What version contains the fixes?

The four CVE fixes are included in version 1.44-tuxcare.1.

Published Nov 9, 2026

Updated

TuxCare rebuilt 3 org.bouncycastle packages to address 4 CVEs. Fixed in 1.44-tuxcare.1.

Affected Software

2 affected componentsFixes available

tuxcare/org.bouncycastle:bcprov-jdk14>=1.44<1.44-tuxcare.1

1.44-tuxcare.1

tuxcare/org.bouncycastle:bcprov-jdk15>=1.44<1.44-tuxcare.1

1.44-tuxcare.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tuxcare/org.bouncycastle:bcprov-jdk14 to a version that resolves this vulnerability.
Fixed in 1.44-tuxcare.1
Upgrade
Upgrade tuxcare/org.bouncycastle:bcprov-jdk15 to a version that resolves this vulnerability.
Fixed in 1.44-tuxcare.1
Upgrade
Upgrade tuxcare/org.bouncycastle:bcprov-jdk16 to a version that resolves this vulnerability.
Fixed in 1.44-tuxcare.1
Upgrade
Upgrade org.bouncycastle to a version that resolves this vulnerability.
Fixed in 1.44-tuxcare.1

Event History

Nov 9, 2026

Advisory Published

via OSV·10:14 AM

Data Sourced

via OSV·10:14 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which packages should be checked for this update?

Check the TuxCare org.bouncycastle packages bcprov-jdk14 and bcprov-jdk15. The advisory states that three org.bouncycastle packages were rebuilt, but only these two package names are identified in the provided software data.

What version contains the fixes?