REDHAT-BUG-2510240: High severity Bouncy Castle Bouncy Castle for Java vulnerability
Published Aug 3, 2026
·Updated
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affected Software
3 affected components
Bouncy Castle Bouncy Castle for Java<1.85
Bouncy Castle Bouncy Castle for Java LTS<2.73.12
Bouncy Castle Bouncy Castle for Java FIPS (BC-FJA)<2.0.2, <2.1.3
Event History
Aug 3, 2026
Data Sourced
via Red Hat·03:02 AM
DescriptionSeverityAffected Software