SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-58060

HIGH · CVSS 8.7 EPSS 0.39% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-03 · Last synced 2026-09-02

CyberRota Analysis

AI-Generated

Bouncy Castle for Java versions prior to 1.85, as well as specific LTS and FIPS versions, are vulnerable due to an unbounded allocation issue during public-key verification, which can lead to excessive memory consumption. This vulnerability could potentially result in denial-of-service conditions if exploited. Organizations utilizing affected versions of Bouncy Castle should prioritize remediation to mitigate the risk of service disruption.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-58060
Severity
HIGH
CVSS
8.7
EPSS
0.39%
Java

Original NVD Description

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).