Debian/bouncycastle: critical 9.1

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Action: Upgrade bouncycastle to 1.86-1 or later.

Affected

introduced	fixed	last affected
0	1.86-1	-

Fixed versions

1.86-1

Sources

osv: DEBIAN-CVE-2026-59650#Debian:14/bouncycastle
https://security-tracker.debian.org/tracker/CVE-2026-59650

published 2026-08-03T01:16:45.250Z · modified 2026-10-03T04:00:09.699350234Z · JSON