{"action":"Upgrade org.bouncycastle:bcprov-lts8on to 2.73.11 or later.","affected":[{"fixed":"2.73.11","introduced":"2.73.0"}],"component":"org.bouncycastle:bcprov-lts8on","cve_ids":["CVE-2026-8149"],"ecosystem":"Maven","epss":0.00158,"exploited":false,"fixed_versions":["2.73.11"],"ghsa_id":"GHSA-mx76-r943-rf8g","id":"tcs_01M5N961AJ7HVNKNMFEN1VSZ6Z","modified_at":"2026-09-10T03:50:47.153340070Z","published_at":"2026-05-08T09:31:30Z","references":["https://osv.dev/vulnerability/GHSA-mx76-r943-rf8g","https://nvd.nist.gov/vuln/detail/CVE-2026-8149","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908149"],"severity":{"label":"medium","score":5.1},"sources":[{"source":"osv","source_id":"GHSA-mx76-r943-rf8g","url":"https://osv.dev/vulnerability/GHSA-mx76-r943-rf8g"},{"source":"nvd","source_id":"CVE-2026-8149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8149"}],"summary":"Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption"}