{"id":"CVE-2026-59645","title":"In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema","summary":"In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcu…","severity":"high","cwe":["CWE-674","CWE-835"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59645","references":[{"url":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59645","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59645.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59645"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510189"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59645"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59645"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.900Z","epss":0.00408,"epssPercentile":0.34915,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-59645","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat Build of Keycloak, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Ceph Storage 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59645.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201837,"id":"CVE-2026-59645","ts":1789399743115,"field":"cvss","old":null,"new":"7.5"},{"seq":201836,"id":"CVE-2026-59645","ts":1789399743115,"field":"severity","old":"none","new":"high"},{"seq":200567,"id":"CVE-2026-59645","ts":1789397412207,"field":"cvss","old":"7.5","new":null},{"seq":200566,"id":"CVE-2026-59645","ts":1789397412207,"field":"severity","old":"high","new":"none"},{"seq":198484,"id":"CVE-2026-59645","ts":1789392001477,"field":"cvss","old":null,"new":"7.5"},{"seq":198483,"id":"CVE-2026-59645","ts":1789392001477,"field":"severity","old":"none","new":"high"},{"seq":196277,"id":"CVE-2026-59645","ts":1789383612088,"field":"cvss","old":"7.5","new":null},{"seq":196276,"id":"CVE-2026-59645","ts":1789383612088,"field":"severity","old":"high","new":"none"},{"seq":195206,"id":"CVE-2026-59645","ts":1789380497188,"field":"cvss","old":null,"new":"7.5"},{"seq":195205,"id":"CVE-2026-59645","ts":1789380497188,"field":"severity","old":"none","new":"high"},{"seq":193993,"id":"CVE-2026-59645","ts":1789378551980,"field":"cvss","old":"7.5","new":null},{"seq":193992,"id":"CVE-2026-59645","ts":1789378551980,"field":"severity","old":"high","new":"none"},{"seq":192780,"id":"CVE-2026-59645","ts":1789376426102,"field":"cvss","old":null,"new":"7.5"},{"seq":192779,"id":"CVE-2026-59645","ts":1789376426102,"field":"severity","old":"none","new":"high"},{"seq":191567,"id":"CVE-2026-59645","ts":1789373454897,"field":"cvss","old":"7.5","new":null},{"seq":191566,"id":"CVE-2026-59645","ts":1789373454897,"field":"severity","old":"high","new":"none"},{"seq":190352,"id":"CVE-2026-59645","ts":1789369346375,"field":"cvss","old":null,"new":"7.5"},{"seq":190351,"id":"CVE-2026-59645","ts":1789369346375,"field":"severity","old":"none","new":"high"},{"seq":189139,"id":"CVE-2026-59645","ts":1789368282975,"field":"cvss","old":"7.5","new":null},{"seq":189138,"id":"CVE-2026-59645","ts":1789368282975,"field":"severity","old":"high","new":"none"},{"seq":187922,"id":"CVE-2026-59645","ts":1789365162006,"field":"cvss","old":null,"new":"7.5"},{"seq":187921,"id":"CVE-2026-59645","ts":1789365162006,"field":"severity","old":"none","new":"high"},{"seq":186709,"id":"CVE-2026-59645","ts":1789363306401,"field":"cvss","old":"7.5","new":null},{"seq":186708,"id":"CVE-2026-59645","ts":1789363306401,"field":"severity","old":"high","new":"none"},{"seq":185495,"id":"CVE-2026-59645","ts":1789361123060,"field":"cvss","old":null,"new":"7.5"},{"seq":185494,"id":"CVE-2026-59645","ts":1789361123060,"field":"severity","old":"none","new":"high"},{"seq":184282,"id":"CVE-2026-59645","ts":1789358181402,"field":"cvss","old":"7.5","new":null},{"seq":184281,"id":"CVE-2026-59645","ts":1789358181402,"field":"severity","old":"high","new":"none"},{"seq":182533,"id":"CVE-2026-59645","ts":1789354238636,"field":"cvss","old":null,"new":"7.5"},{"seq":182532,"id":"CVE-2026-59645","ts":1789354238636,"field":"severity","old":"none","new":"high"},{"seq":181326,"id":"CVE-2026-59645","ts":1789353154235,"field":"cvss","old":"7.5","new":null},{"seq":181325,"id":"CVE-2026-59645","ts":1789353154235,"field":"severity","old":"high","new":"none"},{"seq":180119,"id":"CVE-2026-59645","ts":1789350187394,"field":"cvss","old":null,"new":"7.5"},{"seq":180118,"id":"CVE-2026-59645","ts":1789350187394,"field":"severity","old":"none","new":"high"},{"seq":178912,"id":"CVE-2026-59645","ts":1789348122972,"field":"cvss","old":"7.5","new":null},{"seq":178911,"id":"CVE-2026-59645","ts":1789348122972,"field":"severity","old":"high","new":"none"},{"seq":177705,"id":"CVE-2026-59645","ts":1789346293670,"field":"cvss","old":null,"new":"7.5"},{"seq":177704,"id":"CVE-2026-59645","ts":1789346293670,"field":"severity","old":"none","new":"high"},{"seq":176498,"id":"CVE-2026-59645","ts":1789343044810,"field":"cvss","old":"7.5","new":null},{"seq":176497,"id":"CVE-2026-59645","ts":1789343044810,"field":"severity","old":"high","new":"none"},{"seq":174615,"id":"CVE-2026-59645","ts":1789334801274,"field":"cvss","old":null,"new":"7.5"},{"seq":174614,"id":"CVE-2026-59645","ts":1789334801274,"field":"severity","old":"none","new":"high"},{"seq":173410,"id":"CVE-2026-59645","ts":1789333530909,"field":"cvss","old":"7.5","new":null},{"seq":173409,"id":"CVE-2026-59645","ts":1789333530909,"field":"severity","old":"high","new":"none"},{"seq":172224,"id":"CVE-2026-59645","ts":1789331030700,"field":"cvss","old":null,"new":"7.5"},{"seq":172223,"id":"CVE-2026-59645","ts":1789331030700,"field":"severity","old":"none","new":"high"},{"seq":171038,"id":"CVE-2026-59645","ts":1789328646559,"field":"cvss","old":"7.5","new":null},{"seq":171037,"id":"CVE-2026-59645","ts":1789328646559,"field":"severity","old":"high","new":"none"},{"seq":169833,"id":"CVE-2026-59645","ts":1789327070042,"field":"cvss","old":null,"new":"7.5"},{"seq":169832,"id":"CVE-2026-59645","ts":1789327070042,"field":"severity","old":"none","new":"high"}]}