CVE-2026-59650 (Critical) detected in bcprov-jdk18on-1.80.jar

[mend-bolt-for-github]

CVE-2026-59650 - Critical Severity Vulnerability

Vulnerable Library - bcprov-jdk18on-1.80.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the JCA/JCE provider and low-level API for the BC Java version 1.80 for Java 8 and later.

Library home page: https://www.bouncycastle.org/download/bouncy-castle-java/

Path to dependency file: /OPENAPI-REST-API/openapi-client/kotlin/build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk18on/1.80/e22100b41042decf09cab914a5af8d2c57b5ac4a/bcprov-jdk18on-1.80.jar

Dependency Hierarchy:

• bcpg-jdk18on-1.80.jar (Root Library)
  • ❌ bcprov-jdk18on-1.80.jar (Vulnerable Library)

Found in HEAD commit: 1f70e2feccb7006c8d32cc7d4fe62f5cf5e5c34d

Found in base branch: master

Vulnerability Details

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Publish Date: 2026-08-03

URL: CVE-2026-59650

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,https://github.com/bcgit/bc-java.git - r1rv85

---

Step up your Open Source Security Game with Mend here