Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-59651

Fixed in a distro release EPSS <1%CVSS 7.1

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

Published 2026-08-03 · CVE record · OSV

Products: Legion of the Bouncy Castle Inc. BC-JAVA, Legion of the Bouncy Castle Inc. BC-LTS-JAVA

Distro releases

ReleasePackageFixed in
Debian 12bouncycastleno fix
Debian 13bouncycastleno fix
Debian 14bouncycastle1.86-1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Module for Development Tools 15 SP7bouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server 15 SP4-LTSSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server 15 SP5-LTSSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server 15 SP6-LTSSbouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server 16.0bouncycastle1.85-160000.1.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4bouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5bouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6bouncycastle1.85-150200.3.38.1
SUSE Linux Enterprise Server for SAP applications 16.0bouncycastle1.85-160000.1.1
Ubuntu 26.04 LTSbouncycastleno fix
Ubuntu 26.10bouncycastleno fix
Ubuntu Pro 16.04 LTSbouncycastleno fix
Ubuntu Pro 18.04 LTSbouncycastleno fix
Ubuntu Pro 20.04 LTSbouncycastleno fix
Ubuntu Pro 22.04 LTSbouncycastleno fix
Ubuntu Pro 24.04 LTSbouncycastleno fix
openSUSE Leap 16.0bouncycastle1.85-160000.1.1
openSUSE Tumbleweedbouncycastle1.85-1.1