7.5
CVE-2026-58060
- EPSS 0.37%
- Veröffentlicht 03.08.2026 02:37:43
- Zuletzt bearbeitet 02.09.2026 14:32:13
- Erkennungen
LoginHSS public-key level count unbounded, enabling huge allocation on verify
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bouncycastle ≫ Bc-java Version >= 1.65 < 1.85
Bouncycastle ≫ Bouncy Castle For Java Lts Version <= 2.73.11
Bouncycastle ≫ Fips Java Api Version < 2.0.2
Bouncycastle ≫ Fips Java Api Version >= 2.1.0 < 2.1.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.37% | 0.292 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| 91579145-5d7b-4cc5-b925-a0262ff19630 | 8.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
|
CWE-789 Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276
https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058060