CVE-2026-59645 Details
Description
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
A denial-of-service vulnerability has been identified in Bouncy Castle for Java versions prior to 1.85, as well as in the LTS versions prior to 2.73.12 and in the FIPS versions prior to bcutil-fips 2.0.7. The issue arises in the OER (Object Encoding Rules) parser, which processes self-referential IEEE 1609.2 schema without a depth limit. This lack of restriction allows for crafted input to cause unbounded recursive parsing, leading to a StackOverflowError. The vulnerability exploits the cyclic nature of the schema, where certain data elements can nest within themselves, creating a loop that the parser cannot exit.
Users can upgrade to Bouncy Castle for Java version 1.85 or later, or to version 2.73.12 or later in the LTS series. For the FIPS series, version 2.0.7 or 2.1.7 should be used, depending on the specific FIPS version in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989 | bcorg | Patch |
| https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059645 | bcorg | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | bcorg |
Affected Products
| Product | Versions |
|---|---|
| bouncycastle bc-java | < 1.85 |
CPE
Remediation
| |
| bouncycastle bcutil-fips | >= 2.0.2, < 2.0.7 >= 2.1.4, < 2.1.7 |
CPE
Remediation
| |
| bouncycastle bouncy castle for java lts | <= 2.73.11 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | CVE Modified | bcorg |
| Aug 3, 2026 | New CVE Received | bcorg |