REDHAT-BUG-2510257: High severity Bouncy Castle Bouncy Castle for Java vulnerability

Q: Which releases need to be updated?

Update Bouncy Castle for Java to 1.85 or later, Bouncy Castle for Java LTS to 2.73.12 or later, and BC-FJA to 1.0.2.7 or later in the 1.0.X series, 2.0.2 or later in the 2.0.X series, or 2.1.3 or later in the 2.1.X series.

Q: What condition triggers the issue?

The issue is triggered when a Lazy ASN.1 sequence is forced, which resets the nesting-depth guard.

Published Aug 3, 2026

Updated

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected Software

3 affected components

Bouncy Castle Bouncy Castle for Java<1.85

Bouncy Castle Bouncy Castle for Java LTS<2.73.12

Bouncy Castle Bouncy Castle for Java FIPS (BC-FJA)<1.0.2.7, <2.0.2, <2.1.3

Event History

Aug 3, 2026

Data Sourced

via Red Hat·04:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which releases need to be updated?

Update Bouncy Castle for Java to 1.85 or later, Bouncy Castle for Java LTS to 2.73.12 or later, and BC-FJA to 1.0.2.7 or later in the 1.0.X series, 2.0.2 or later in the 2.0.X series, or 2.1.3 or later in the 2.1.X series.

What condition triggers the issue?

The issue is triggered when a Lazy ASN.1 sequence is forced, which resets the nesting-depth guard.

REDHAT-BUG-2510257: High severity Bouncy Castle Bouncy Castle for Java vulnerability

Affected Software

Event History

Frequently Asked Questions

Which releases need to be updated?

What condition triggers the issue?

Company

Resources

Contact

Frequently Asked Questions

Which releases need to be updated?

What condition triggers the issue?