CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59645?
CVE-2026-59645 has a risk rating of 37.
How do I fix CVE-2026-59645?
To fix CVE-2026-59645, you should upgrade to Bouncy Castle for Java version 1.85 or later, or to the appropriate versions of Bouncy Castle for Java LTS and FIPS.
Which versions of Bouncy Castle are affected by CVE-2026-59645?
CVE-2026-59645 affects Bouncy Castle for Java before version 1.85, Bouncy Castle for Java LTS before version 2.73.12, and Bouncy Castle for Java FIPS before bcutil-fips 2.0.7 and 2.1.7.
What is the nature of the vulnerability in CVE-2026-59645?
CVE-2026-59645 involves the OER parser recursing without a depth limit on self-referential IEEE 1609.2 schema.
Is CVE-2026-59645 applicable to all Bouncy Castle libraries?
CVE-2026-59645 specifically affects Bouncy Castle for Java, Bouncy Castle for Java LTS, and Bouncy Castle for Java FIPS implementations.