{"id":"CVE-2026-12185","title":"In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check","summary":"In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.","severity":"medium","cwe":["CWE-789","CWE-1284"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12185","references":[{"url":"https://github.com/bcgit/bc-java/commit/7bbd7fe5f44132e5b6140a2914435c12430eeb3d","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-12185","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12185.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-12185"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510202"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12185"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12185"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.564Z","epss":0.00291,"epssPercentile":0.21523,"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","affected":["amq_broker 7","build_of_apache_camel_for_spring_boot 4","build_of_keycloak","ceph_storage 9","fuse 7","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform 8","jboss_enterprise_application_platform_expansion_pack","single_sign_on 7","openshift_developer_tools_and_services","ansible_automation_platform 2","openshift_ai_rhoai","openshift_dev_spaces","satellite 6"],"cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-12185","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Build of Keycloak, Red Hat Ceph Storage 9, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, OpenShift Developer Tools and Services, Red Hat AMQ Broker 7, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12185.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":220013,"id":"CVE-2026-12185","ts":1791978455493,"field":"cvss","old":null,"new":"6.5"},{"seq":220012,"id":"CVE-2026-12185","ts":1791978455493,"field":"severity","old":"none","new":"medium"}]}