Debian/bouncycastle: critical 9.1

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

osv: DEBIAN-CVE-2026-59650#Debian:13/bouncycastle
https://security-tracker.debian.org/tracker/CVE-2026-59650

published 2026-08-03T01:16:45.250Z · modified 2026-10-03T04:00:09.699350234Z · JSON