Bouncycastle Bcpg-fips — known CVE vulnerabilities

Every CVE whose affected-product data names Bouncycastle Bcpg-fips, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2026-12817 — CVSS 8.6 (high): In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle…
• CVE-2026-59643 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for…
• CVE-2026-59649 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects…
• CVE-2026-59640 — CVSS 5.3 (medium): In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy…
• CVE-2026-59648 — CVSS 5.3 (medium): In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle…