CVE-2026-58062

CriticalCVSS 9.3

Published: 03/08/2026(UTC)Translated: 03/08/2026(UTC)NVD NIST

Summary

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Risk Assessment

An attacker could exploit this vulnerability to accept an invalid or forged certificate revocation status, potentially leading to trust compromise in TLS communication.

Recommendation

Upgrade Bouncy Castle to version 1.85 or later (for the regular version), to 2.73.12 or later (for LTS), and to the appropriate FIPS versions.

Original NVD description (English source)

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).