High CVSS 7.1

CVE-2026-12185

In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

What this means

Exposure: Exploitable remotely over the network and without authentication — but only if a user opens booby-trapped content.
Impact: An attacker can take the service offline.
Weakness: An attacker-supplied size triggers an oversized allocation.
Likelihood: Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 3 August 2026
CVSS: 7.1 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
EPSS: 0.23% probability of exploitation within 30 days · above 14% of all CVEs
Weakness: CWE-789
Sources: nvd

References

https://nvd.nist.gov/vuln/detail/CVE-2026-12185