{"id":"CVE-2026-59651","title":"In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key","summary":"In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.","severity":"high","cwe":["CWE-326","CWE-1240"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59651","references":[{"url":"https://github.com/bcgit/bc-java/commit/faf5daa6e9b8460f862afc0af1cc0da365f7d4d2","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59651","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59651.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59651"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510188"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59651"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59651"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:08.072Z","epss":0.00196,"epssPercentile":0.09254,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","slug":"CVE-2026-59651","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: OpenShift Developer Tools and Services, Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat Build of Keycloak, Red Hat Enterprise Linux 9, … · no fix planned: Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat OpenStack Platform 13 (Queens), … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59651.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201843,"id":"CVE-2026-59651","ts":1789399743161,"field":"cvss","old":null,"new":"7.5"},{"seq":201842,"id":"CVE-2026-59651","ts":1789399743161,"field":"severity","old":"none","new":"high"},{"seq":200573,"id":"CVE-2026-59651","ts":1789397412248,"field":"cvss","old":"7.5","new":null},{"seq":200572,"id":"CVE-2026-59651","ts":1789397412248,"field":"severity","old":"high","new":"none"},{"seq":198490,"id":"CVE-2026-59651","ts":1789392001517,"field":"cvss","old":null,"new":"7.5"},{"seq":198489,"id":"CVE-2026-59651","ts":1789392001517,"field":"severity","old":"none","new":"high"},{"seq":196283,"id":"CVE-2026-59651","ts":1789383612129,"field":"cvss","old":"7.5","new":null},{"seq":196282,"id":"CVE-2026-59651","ts":1789383612129,"field":"severity","old":"high","new":"none"},{"seq":195212,"id":"CVE-2026-59651","ts":1789380497224,"field":"cvss","old":null,"new":"7.5"},{"seq":195211,"id":"CVE-2026-59651","ts":1789380497224,"field":"severity","old":"none","new":"high"},{"seq":193999,"id":"CVE-2026-59651","ts":1789378552023,"field":"cvss","old":"7.5","new":null},{"seq":193998,"id":"CVE-2026-59651","ts":1789378552023,"field":"severity","old":"high","new":"none"},{"seq":192786,"id":"CVE-2026-59651","ts":1789376426140,"field":"cvss","old":null,"new":"7.5"},{"seq":192785,"id":"CVE-2026-59651","ts":1789376426140,"field":"severity","old":"none","new":"high"},{"seq":191573,"id":"CVE-2026-59651","ts":1789373454938,"field":"cvss","old":"7.5","new":null},{"seq":191572,"id":"CVE-2026-59651","ts":1789373454938,"field":"severity","old":"high","new":"none"},{"seq":190358,"id":"CVE-2026-59651","ts":1789369347256,"field":"cvss","old":null,"new":"7.5"},{"seq":190357,"id":"CVE-2026-59651","ts":1789369347256,"field":"severity","old":"none","new":"high"},{"seq":189145,"id":"CVE-2026-59651","ts":1789368283016,"field":"cvss","old":"7.5","new":null},{"seq":189144,"id":"CVE-2026-59651","ts":1789368283016,"field":"severity","old":"high","new":"none"},{"seq":187928,"id":"CVE-2026-59651","ts":1789365162045,"field":"cvss","old":null,"new":"7.5"},{"seq":187927,"id":"CVE-2026-59651","ts":1789365162045,"field":"severity","old":"none","new":"high"},{"seq":186715,"id":"CVE-2026-59651","ts":1789363306441,"field":"cvss","old":"7.5","new":null},{"seq":186714,"id":"CVE-2026-59651","ts":1789363306441,"field":"severity","old":"high","new":"none"},{"seq":185501,"id":"CVE-2026-59651","ts":1789361123098,"field":"cvss","old":null,"new":"7.5"},{"seq":185500,"id":"CVE-2026-59651","ts":1789361123098,"field":"severity","old":"none","new":"high"},{"seq":184288,"id":"CVE-2026-59651","ts":1789358181442,"field":"cvss","old":"7.5","new":null},{"seq":184287,"id":"CVE-2026-59651","ts":1789358181442,"field":"severity","old":"high","new":"none"},{"seq":182539,"id":"CVE-2026-59651","ts":1789354238683,"field":"cvss","old":null,"new":"7.5"},{"seq":182538,"id":"CVE-2026-59651","ts":1789354238683,"field":"severity","old":"none","new":"high"},{"seq":181332,"id":"CVE-2026-59651","ts":1789353154526,"field":"cvss","old":"7.5","new":null},{"seq":181331,"id":"CVE-2026-59651","ts":1789353154526,"field":"severity","old":"high","new":"none"},{"seq":180125,"id":"CVE-2026-59651","ts":1789350187438,"field":"cvss","old":null,"new":"7.5"},{"seq":180124,"id":"CVE-2026-59651","ts":1789350187438,"field":"severity","old":"none","new":"high"},{"seq":178918,"id":"CVE-2026-59651","ts":1789348123013,"field":"cvss","old":"7.5","new":null},{"seq":178917,"id":"CVE-2026-59651","ts":1789348123013,"field":"severity","old":"high","new":"none"},{"seq":177711,"id":"CVE-2026-59651","ts":1789346293713,"field":"cvss","old":null,"new":"7.5"},{"seq":177710,"id":"CVE-2026-59651","ts":1789346293713,"field":"severity","old":"none","new":"high"},{"seq":176504,"id":"CVE-2026-59651","ts":1789343045749,"field":"cvss","old":"7.5","new":null},{"seq":176503,"id":"CVE-2026-59651","ts":1789343045749,"field":"severity","old":"high","new":"none"},{"seq":174621,"id":"CVE-2026-59651","ts":1789334801312,"field":"cvss","old":null,"new":"7.5"},{"seq":174620,"id":"CVE-2026-59651","ts":1789334801312,"field":"severity","old":"none","new":"high"},{"seq":173416,"id":"CVE-2026-59651","ts":1789333531887,"field":"cvss","old":"7.5","new":null},{"seq":173415,"id":"CVE-2026-59651","ts":1789333531887,"field":"severity","old":"high","new":"none"},{"seq":172230,"id":"CVE-2026-59651","ts":1789331030739,"field":"cvss","old":null,"new":"7.5"},{"seq":172229,"id":"CVE-2026-59651","ts":1789331030739,"field":"severity","old":"none","new":"high"},{"seq":171044,"id":"CVE-2026-59651","ts":1789328646607,"field":"cvss","old":"7.5","new":null},{"seq":171043,"id":"CVE-2026-59651","ts":1789328646607,"field":"severity","old":"high","new":"none"},{"seq":169839,"id":"CVE-2026-59651","ts":1789327070079,"field":"cvss","old":null,"new":"7.5"},{"seq":169838,"id":"CVE-2026-59651","ts":1789327070079,"field":"severity","old":"none","new":"high"}]}