CVE-2026-58062
Received Received - Intake

OCSP Response Validation Flaw in Bouncy Castle Java

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-58062
EUVD
EUVD-2026-52089

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
bouncy_castle bouncy_castle to 1.85 (exc)
bouncy_castle bouncy_castle_lts to 2.73.12 (exc)
bouncy_castle bc_fips to 2.0.2 (exc)
bouncy_castle bc_fips to 2.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In Bouncy Castle for Java versions before 1.85, there is a vulnerability where stapled OCSP responses are accepted without proper binding to the checked certificate. This means the system may trust revoked or invalid certificates if an OCSP response is stapled but not correctly verified against the certificate.

Detection Guidance

Detection requires checking the Bouncy Castle library version in use. Compare installed versions against the patched releases: Java before 1.85, LTS before 2.73.12, BC-FJA before 2.0.2 (2.0.X) or 2.1.3 (2.1.X). Use commands like 'mvn dependency:tree' for Maven projects or 'find / -name "bc*.jar"' to locate Bouncy Castle JAR files and inspect their version metadata.

Impact Analysis

This vulnerability could allow attackers to bypass certificate validation, leading to man-in-the-middle attacks or unauthorized access to sensitive data. Systems using vulnerable Bouncy Castle versions may accept fraudulent certificates, compromising secure communications.

Compliance Impact

This vulnerability may violate compliance requirements that mandate secure certificate validation, such as GDPR's data protection principles or HIPAA's security rules for protected health information. Non-compliance could result in legal penalties or data breaches.

Mitigation Strategies

Update Bouncy Castle for Java to version 1.85 or later, Bouncy Castle LTS to 2.73.12 or later, and BC-FJA to bc-fips 2.0.2 (2.0.X series) or 2.1.3 (2.1.X series) or newer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart