CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender
Published Aug 3, 2026
·Updated
In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.
Affected Software
1 affected component
Bouncy Castle Java<1.85
Event History
Aug 3, 2026
CVE Published
via MITRE·12:50 AM
Data Sourced
via MITRE·12:50 AM
DescriptionWeakness
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-59644?
CVE-2026-59644 has a risk score of 47, indicating a significant level of impact.
2
What software is affected by CVE-2026-59644?
Bouncy Castle for Java versions prior to 1.85 are affected by CVE-2026-59644.
3
How do I fix CVE-2026-59644?
To fix CVE-2026-59644, upgrade Bouncy Castle for Java to version 1.85 or later.
4
What vulnerability does CVE-2026-59644 address?
CVE-2026-59644 addresses an issue where MLS hash-ratchet honors an arbitrary 32-bit generation counter from the sender.
5
When was CVE-2026-59644 published?
CVE-2026-59644 was published on August 3, 2026.