CVE-2026-59644
CVE-2026-59644 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-834.
Key facts
- Severity: High (CVSS 4.0 base score 8.7)
- EPSS exploit prediction: 0% (18th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-834
- Published:
- Last modified:
Description
In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.
Frequently asked questions
- What is CVE-2026-59644?
- In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.
- How severe is CVE-2026-59644?
- CVE-2026-59644 has a CVSS 4.0 base score of 8.7, rated high severity.
- Is CVE-2026-59644 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-59644?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-59644 published?
- CVE-2026-59644 was published on 2026-08-03 and last updated on 2026-08-04.
References
- https://github.com/bcgit/bc-java/commit/610d8757d855afe197df0de6d831cb75c81e3b9f
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059644
Other CWE-834 (Excessive Iteration) vulnerabilities
- CVE-2017-12587 — High (CVSS 8.8): ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.
- CVE-2024-42071 — High (CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved: ionic: use dev_consume_skb_any outside of napi If…
- CVE-2026-64641 — High (CVSS 7.5): Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0…
- CVE-2025-62707 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this…
- CVE-2025-56571 — High (CVSS 7.5): Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper…
- CVE-2024-4227 — High (CVSS 7.5): In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when…