CVE-2026-59651
Received Received - Intake

BKS Keystore Integrity Bypass in Bouncy Castle Java

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-59651
EUVD
EUVD-2026-52023

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bouncy_castle bouncy_castle_for_java to 1.85 (exc)
bouncy_castle bouncy_castle_for_java_lts to 2.73.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Bouncy Castle for Java versions before 1.85 and Bouncy Castle for Java LTS before 2.73.12 accepting a legacy BKS keystore version with a 16-bit integrity MAC key. This weak integrity check could allow unauthorized modifications to the keystore without detection.

Detection Guidance

This vulnerability affects Bouncy Castle for Java versions before 1.85 and Bouncy Castle for Java LTS before 2.73.12. To detect it, check the installed version of Bouncy Castle in your Java environment. Use commands like 'mvn dependency:tree' for Maven projects or inspect the JAR files in your classpath for the version number.

Impact Analysis

An attacker could exploit this to alter the contents of a BKS keystore without detection, potentially leading to unauthorized access to encrypted data or impersonation of legitimate users. This could compromise the confidentiality and integrity of sensitive information stored in the keystore.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by failing to ensure the integrity and confidentiality of personal or health data. Organizations using affected versions may be unable to demonstrate adequate security controls, risking legal penalties and reputational damage.

Mitigation Strategies

Upgrade Bouncy Castle for Java to version 1.85 or later and Bouncy Castle for Java LTS to version 2.73.12 or later to address the legacy BKS keystore issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59651. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart