CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58062?
CVE-2026-58062 has a severity rating of critical with a CVSS score of 9.3.
How do I fix CVE-2026-58062?
To fix CVE-2026-58062, upgrade to Bouncy Castle for Java versions 1.85 or later, LTS versions 2.73.12 or later, or FIPS version 2.0.2 or 2.1.3.
What software is affected by CVE-2026-58062?
CVE-2026-58062 affects Bouncy Castle for Java, Bouncy Castle for Java LTS, and Bouncy Castle for Java FIPS (BC-FJA) prior to their respective fixed versions.
Is CVE-2026-58062 a remote code execution vulnerability?
CVE-2026-58062 is not a remote code execution vulnerability but allows for the acceptance of stapled OCSP responses without proper binding.
What impact does CVE-2026-58062 have on security?
CVE-2026-58062 may lead to improper validation of OCSP responses, potentially compromising certificate validation security.