CVE-2026-12852

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.

In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the PKCS#12 MAC and bag-decryption KDF iteration-count bound can lead to DoS. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, a Lazy ASN.1 sequence forces resetting the nesting-depth guard. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, RSA PKCS#1 signature verification skips the last two hash bytes in the NULL-omitted path. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips the final tag on chunk-aligned data. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the IESEngine in stream mode allows MAC forgery via length-dependent KDF split. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the KCCMBlockCipher MAC does not bind the nonce when AAD is absent, allowing cross-nonce AEAD forgery. This also affects Bouncy Castle for Java LTS before 2.73.12.