CVE-2026-59638 Details
Description
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
A vulnerability exists in Bouncy Castle for Java in versions prior to 1.85, as well as in the LTS version prior to 2.73.12 and in Bouncy Castle for Java FIPS (BC-FJA) versions prior to bctls-fips 1.0.24, 2.0.24 and 2.1.24. The issue arises because the JSSE hostname verifier's CN-fallback feature is enabled by default, contrary to the documented opt-in requirement. This flaw can lead to improper hostname verification in certain TLS scenarios, potentially allowing man-in-the-middle attacks by accepting certificates that do not meet the standard verification requirements.
Users can update to Bouncy Castle for Java version 1.85 or later, or to the Bouncy Castle for Java LTS version 2.73.12 or later. For Bouncy Castle for Java FIPS (BC-FJA) users, the library should be updated to version bctls-fips 1.0.24, 2.0.24 or 2.1.24.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bcgit/bc-java/commit/5ac55351cd1a8a7184d41c96a7ee87df0770240a | bcorg | Patch |
| https://github.com/bcgit/bc-java/commit/799bd15320a6310a447863638aa3df64acef829b | bcorg | Patch |
| https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059638 | bcorg | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-297 | Improper Validation of Certificate with Host Mismatch | bcorg |
Affected Products
| Product | Versions |
|---|---|
| bouncycastle bc-java | < 1.85 |
CPE
Remediation
| |
| bouncycastle bctls-fips | >= 1.0.0, < 1.0.24 >= 2.0.19, < 2.0.24 >= 2.1.20, < 2.1.24 |
CPE
Remediation
| |
| bouncycastle bouncy castle for java lts | <= 2.73.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | Reanalysis | [email protected] |
| Aug 28, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | CVE Modified | bcorg |
| Aug 3, 2026 | New CVE Received | bcorg |