CVE-2026-58062
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- Published Aug 3, 2026
- CVSS 9.3 critical
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- Multiple vulnerabilities in IBM products CERT-FR ·
- Multiple vulnerabilities in IBM products CERT-FR ·