Stapled OCSP response accepted without binding to the checked certificate
Summary
| CVE | CVE-2026-58062 |
|---|---|
| State | PUBLISHED |
| Assigner | bcorg |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-03 03:16:45 UTC |
| Updated | 2026-09-02 14:33:49 UTC |
| Description | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from 91579145-5d7b-4cc5-b925-a0262ff19630
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
EPSS: 0.002030000 probability, percentile 0.103870000 (date 2026-08-07)
Problem Types: CWE-295 | CWE-295 CWE-295 Improper Certificate Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 91579145-5d7b-4cc5-b925-a0262ff19630 | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber |
| 3.1 | [email protected] | Primary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bouncycastle | Bc-java | All | All | All | All |
| Application | Bouncycastle | Bouncy Castle For Java Lts | All | All | All | All |
| Application | Bouncycastle | Fips Java Api | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Legion Of The Bouncy Castle Inc. | BC-JAVA | affected 1.66 1.85 maven | all |
| CNA | Legion Of The Bouncy Castle Inc. | BC-LTS-JAVA | affected 2.73.0 2.73.12 maven | all |
| CNA | Legion Of The Bouncy Castle Inc. | BC-FJA | affected 2.0.0 2.0.2 maven | all |
| CNA | Legion Of The Bouncy Castle Inc. | BC-FJA | affected 2.1.0 2.1.3 maven | all |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058062 | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | Third Party Advisory, Patch |
| github.com/bcgit/bc-java/commit/add5f822660f3b2c29fd824e2f4095469c42a1c7 | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | Patch |
| github.com/bcgit/bc-java/wiki/CVE-2026-58062 | MITRE | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Alex Gaynor in collaboration with Claude and Anthropic Research (en)
There are currently no legacy QID mappings associated with this CVE.