CVE-2026-59646: DTLS handshake reassembler allocates buffer from unchecked 24-bit length
In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59646?
The severity of CVE-2026-59646 is rated at 55, indicating a moderate risk.
How do I fix CVE-2026-59646?
To fix CVE-2026-59646, upgrade to Bouncy Castle for Java version 1.85 or later, or corresponding LTS and FIPS versions.
Which versions are affected by CVE-2026-59646?
CVE-2026-59646 affects Bouncy Castle for Java before version 1.85 and LTS versions before 2.73.12.
What types of applications are impacted by CVE-2026-59646?
Applications using Bouncy Castle for Java for DTLS handshake processing are impacted by CVE-2026-59646.
Is CVE-2026-59646 a known vulnerability in Bouncy Castle FIPS?
Yes, CVE-2026-59646 also affects Bouncy Castle for Java FIPS versions before bctls-fips 1.0.24, 2.0.24, and 2.1.24.