CVE-2026-13506
Fixed in a distro release EPSS <1%CVSS 8.7
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Products: Legion of the Bouncy Castle Inc. BC-JAVA, Legion of the Bouncy Castle Inc. BC-LTS-JAVA, Legion of the Bouncy Castle Inc. BC-FJA
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.bouncycastle:bc-fips | 1.0.2.7 |
| Maven | org.bouncycastle:bc-fips | 2.0.2 |
| Maven | org.bouncycastle:bc-fips | 2.1.3 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | 1.85 |
| Maven | org.bouncycastle:bcprov-jdk18on | 1.85 |
| Maven | org.bouncycastle:bcprov-lts8on | 2.73.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| Amazon Linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| Amazon Linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| Amazon Linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| Amazon Linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| Amazon Linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| Amazon Linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| Chainguard | airbyte-platform-workload-launcher | 2.0.0-r8 |
| Chainguard | apache-nifi-2.11 | no fix |
| Chainguard | apache-nifi-2.12 | 2.12.0-r1 |
| Chainguard | apache-nifi-registry-2.11 | 2.11.0-r4 |
| Chainguard | apache-nifi-registry-2.12 | 2.12.0-r1 |
| Chainguard | apache-pulsar-4.0 | 4.0.13-r4 |
| Chainguard | apache-pulsar-4.2 | 4.2.4-r5 |
| Chainguard | apache-pulsar-fips-4.0 | 4.0.13-r4 |
| Chainguard | apache-pulsar-fips-4.2 | 4.2.4-r5 |
| Chainguard | bouncycastle-fips | 2.1.3-r0 |
| Chainguard | camunda-8.8 | 8.8.39-r1 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r13 |
| Chainguard | camunda-zeebe-8.7 | 8.7.41-r1 |
| Chainguard | camunda-zeebe-8.8 | 8.8.39-r1 |
| Chainguard | cassandra-fips-4.0 | 4.0.21-r2 |
| Chainguard | cassandra-fips-4.1 | 4.1.12-r2 |
| Chainguard | cassandra-fips-5.0 | 5.0.8-r15 |
| Chainguard | commercial-elasticsearch-8.17 | no fix |
| Chainguard | commercial-elasticsearch-9.2 | no fix |
| Chainguard | commercial-elasticsearch-9.3 | no fix |
| Chainguard | conductor | 3.32.4-r1 |
| Chainguard | druid | 37.0.0-r57 |
| Chainguard | eco-java-gradle-7.6.5 | no fix |
| Chainguard | eco-java-gradle-7.6.6 | no fix |
| Chainguard | eco-java-gradle-8.10 | no fix |
| Chainguard | eco-java-gradle-8.10.1 | no fix |
| Chainguard | eco-java-gradle-8.10.2 | no fix |
| Chainguard | eco-java-gradle-8.11 | no fix |
| Chainguard | eco-java-gradle-8.11.1 | no fix |
| Chainguard | eco-java-gradle-8.12 | no fix |
| Chainguard | eco-java-gradle-8.12.1 | no fix |
| Chainguard | eco-java-gradle-8.13 | no fix |
| Chainguard | eco-java-gradle-8.14 | no fix |
| Chainguard | eco-java-gradle-8.14.1 | no fix |
| Chainguard | eco-java-gradle-8.14.2 | no fix |
| Chainguard | eco-java-gradle-8.14.3 | no fix |
| Chainguard | eco-java-gradle-8.14.4 | no fix |
| Chainguard | eco-java-gradle-8.14.5 | no fix |
| Chainguard | eco-java-gradle-8.8 | no fix |
| Chainguard | eco-java-gradle-8.9 | no fix |
| Chainguard | eco-java-gradle-9.0.0 | no fix |
| Chainguard | eco-java-gradle-9.1.0 | no fix |
| Chainguard | eco-java-gradle-9.2.0 | no fix |
| Chainguard | eco-java-gradle-9.2.1 | no fix |
| Chainguard | eco-java-gradle-9.3.0 | no fix |
| Chainguard | eco-java-gradle-9.3.1 | no fix |
| Chainguard | eco-java-gradle-9.4.0 | no fix |
| Chainguard | eco-java-gradle-9.4.1 | no fix |
| Chainguard | eco-java-gradle-9.5.0 | no fix |
| Chainguard | eco-java-gradle-9.5.1 | no fix |
| Chainguard | eco-java-gradle-9.6.0 | no fix |
| Chainguard | eco-java-gradle-9.6.1 | no fix |
| Chainguard | eco-java-gradle-9.7.0 | no fix |
| Chainguard | elasticsearch-9.2 | no fix |
| Chainguard | elasticsearch-9.2 | 9.2.8-r15 |
| Chainguard | elasticsearch-9.3 | no fix |
| Chainguard | geoserver-2.27 | 2.27.6-r2 |
| Chainguard | geoserver-2.28 | 2.28.5-r2 |
| Chainguard | geoserver-3.0 | 3.0.1-r4 |
| Chainguard | ghidra | 12.1.4-r1 |
| Chainguard | guacamole-client-extensions | 1.6.0-r17 |
| Chainguard | guacamole-client-extensions | 1.6.0-r16 |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | 3.5.0-r16 |
| Chainguard | hono-adapter-mqtt | 2.7.0-r41 |
| Chainguard | jenkins-2.541 | no fix |
| Chainguard | jenkins-2.541-openjdk-17 | no fix |
| Chainguard | jenkins-2.541-openjdk-21 | no fix |
| Chainguard | jenkins-2.541-openjdk-25 | no fix |
| Chainguard | jenkins-2.555 | no fix |
| Chainguard | jenkins-2.555-openjdk-21 | no fix |
| Chainguard | jenkins-2.555-openjdk-25 | no fix |
| Chainguard | jenkins-2.568 | 2.568.3-r1 |
| Chainguard | jenkins-2.568-openjdk-21 | 2.568.3-r1 |
| Chainguard | jenkins-2.568-openjdk-25 | 2.568.3-r1 |
| Chainguard | kayenta-2025.2 | 2025.2.4-r11 |
| Chainguard | kayenta-2025.4 | 2025.4.6-r16 |
| Chainguard | kayenta-2026.0 | 2026.0.7-r5 |
| Chainguard | kayenta-2026.1 | 2026.1.2-r7 |
| Chainguard | kayenta-2026.2 | 2026.2.5-r3 |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.2 | 2025.2.4-r11 |
| Chainguard | kayenta-fips-2025.4 | 2025.4.6-r9 |
| Chainguard | kayenta-fips-2026.0 | 2026.0.5-r5 |
| Chainguard | kayenta-fips-2026.1 | 2026.1.2-r7 |
| Chainguard | kayenta-fips-2026.2 | 2026.2.5-r3 |
| Chainguard | keycloak-26.5 | no fix |
| Chainguard | keycloak-26.5-iamguarded-compat | no fix |
| Chainguard | keycloak-26.6 | 26.6.7-r1 |
| Chainguard | keycloak-26.6-iamguarded-compat | 26.6.7-r1 |
| Chainguard | keycloak-26.7 | 26.7.4-r1 |
| Chainguard | keycloak-26.7-iamguarded-compat | 26.7.4-r1 |
| Chainguard | keycloak-fips-26.6 | 26.6.7-r1 |
| Chainguard | keycloak-fips-26.6-iamguarded-fips | 26.6.7-r1 |
| Chainguard | keycloak-fips-26.7 | 26.7.4-r1 |
| Chainguard | keycloak-fips-26.7-iamguarded-fips | 26.7.4-r1 |
| Chainguard | kserve-modelmesh | 0.12.0-r40 |
| Chainguard | logstash-8.19 | 8.19.21-r6 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.21-r6 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.21-r6 |
| Chainguard | logstash-9.2 | no fix |
| Chainguard | logstash-9.2-iamguarded-compat | no fix |
| Chainguard | logstash-9.2-with-output-opensearch | no fix |
| Chainguard | logstash-9.3 | no fix |
| Chainguard | logstash-9.3-iamguarded-compat | no fix |
| Chainguard | logstash-9.4 | no fix |
| Chainguard | logstash-9.4 | 9.4.8-r0 |
| Chainguard | logstash-9.4-iamguarded-compat | no fix |
| Chainguard | logstash-9.4-iamguarded-compat | 9.4.8-r0 |
| Chainguard | logstash-9.5 | 9.5.5-r0 |
| Chainguard | logstash-9.5-iamguarded-compat | 9.5.5-r0 |
| Chainguard | logstash-fips-9.4 | 9.4.7-r6 |
| Chainguard | logstash-fips-9.4-iamguarded-compat | 9.4.7-r6 |
| Chainguard | logstash-fips-9.5 | 9.5.4-r9 |
| Chainguard | logstash-fips-9.5-iamguarded-compat | 9.5.4-r8 |
| Chainguard | logstash-fips-9.5-iamguarded-compat | 9.5.4-r9 |
| Chainguard | nacos | 3.2.4-r2 |
| Chainguard | nacos-docker | 3.2.4-r2 |
| Chainguard | nuxeo-2023 | 2023.45-r16 |
| Chainguard | nuxeo-2025 | 2025.20-r1 |
| Chainguard | opensearch-2 | 2.19.6-r11 |
| Chainguard | opensearch-2-identity-shiro | 2.19.6-r12 |
| Chainguard | opensearch-2-ingest-attachment | 2.19.6-r12 |
| Chainguard | opensearch-2-ml-commons | 2.19.6-r11 |
| Chainguard | opensearch-2-performance-analyzer | 2.19.6-r12 |
| Chainguard | opensearch-2-security | 2.19.6-r12 |
| Chainguard | opensearch-2-sql | 2.19.6-r12 |
| Chainguard | pinot | no fix |
| Chainguard | pinot-fips | no fix |
| Chainguard | ranger | 2.9.0-r6 |
| Chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r28 |
| Chainguard | request-9047-keycloak-fips-26.5-iamguarded-fips | 26.5.7-r28 |
| Chainguard | request-9047-keycloak-fips-26.6 | 26.6.7-r1 |
| Chainguard | request-9047-keycloak-fips-26.6-iamguarded-fips | 26.6.7-r1 |
| Chainguard | request-9047-keycloak-fips-26.7-iamguarded-fips | 26.7.4-r1 |
| Chainguard | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| Chainguard | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| Chainguard | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| Chainguard | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| Chainguard | spark-4.0-scala-2.13 | 4.0.4-r5 |
| Chainguard | wazuh-indexer | 4.14.7-r6 |
| Chainguard | wazuh-indexer-plugin-ml-commons | 4.14.7-r6 |
| Chainguard | wazuh-indexer-plugin-performance-analyzer | 4.14.7-r6 |
| Chainguard | wazuh-indexer-plugin-security | 4.14.7-r6 |
| Chainguard | wazuh-indexer-plugin-sql | 4.14.7-r6 |
| Chainguard | wso2is | 7.3.0-r4 |
| Chainguard | zipkin | no fix |
| Chainguard | zipkin | 3.6.1-r28 |
| Chainguard | zipkin-slim | no fix |
| Chainguard | zipkin-slim | 3.6.1-r28 |
| Debian 12 | bouncycastle | no fix |
| Debian 13 | bouncycastle | no fix |
| Debian 14 | bouncycastle | 1.86-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server 16.0 | bouncycastle | 1.85-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | bouncycastle | 1.85-150200.3.38.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | bouncycastle | 1.85-160000.1.1 |
| Ubuntu 26.04 LTS | bouncycastle | no fix |
| Ubuntu 26.10 | bouncycastle | no fix |
| Ubuntu Pro 16.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 18.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 20.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 22.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 24.04 LTS | bouncycastle | no fix |
| Wolfi | apache-pulsar-4.2 | 4.2.4-r5 |
| Wolfi | druid | 37.0.0-r57 |
| Wolfi | keycloak-26.5 | no fix |
| Wolfi | keycloak-26.5-iamguarded-compat | no fix |
| Wolfi | keycloak-26.6 | 26.6.7-r1 |
| Wolfi | keycloak-26.6-iamguarded-compat | 26.6.7-r1 |
| Wolfi | kserve-modelmesh | 0.12.0-r40 |
| Wolfi | logstash-9.3 | no fix |
| Wolfi | logstash-9.3-iamguarded-compat | no fix |
| Wolfi | logstash-9.4 | 9.4.8-r0 |
| Wolfi | logstash-9.4 | no fix |
| Wolfi | logstash-9.4-iamguarded-compat | no fix |
| Wolfi | logstash-9.4-iamguarded-compat | 9.4.8-r0 |
| Wolfi | opensearch-2 | 2.19.6-r11 |
| Wolfi | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| Wolfi | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| Wolfi | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| Wolfi | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| Wolfi | spark-4.0-scala-2.13 | 4.0.4-r5 |
| Wolfi | zipkin | no fix |
| Wolfi | zipkin | 3.6.1-r28 |
| Wolfi | zipkin-slim | 3.6.1-r28 |
| Wolfi | zipkin-slim | no fix |
| openSUSE Leap 16.0 | bouncycastle | 1.85-160000.1.1 |
| openSUSE Tumbleweed | bouncycastle | 1.85-1.1 |