CVE-2026-59648
- Source
- https://cve.org/CVERecord?id=CVE-2026-59648
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59648.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-59648
- Downstream
CLEANSTART (6)
DEBIAN (1)
openSUSE (2)
UBUNTU (1)
- Related
- Published
- 2026-08-03T00:45:34Z
- Modified
- 2026-10-28T10:55:42Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
- Summary
- OpenPGP Argon2 S2K honours attacker-chosen memory and passes
- Details
-
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
- Database specific
{ "cna_assigner": "bcorg", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59648.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "1.0.6" }, { "fixed": "1.0.13" }, { "introduced": "2.0.0" }, { "fixed": "2.0.13" }, { "introduced": "2.1.0" }, { "fixed": "2.1.13" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
-
- https://www.bouncycastle.org/download/bouncy-castle-java-fips/
- https://www.bouncycastle.org/download/bouncy-castle-java-lts/
- https://www.bouncycastle.org/download/bouncy-castle-java/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59648.json
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059648
- https://nvd.nist.gov/vuln/detail/CVE-2026-59648
- https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-lts-java
Affected packages
Git / github.com/bcgit/bc-java
Affected ranges
- Type
- GIT
- Repo
- https://github.com/bcgit/bc-java
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.71" }, { "fixed": "1.85" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799" } ], "source": "REFERENCES_COMMIT" } ] }
- Type
- GIT
- Repo
- https://github.com/bcgit/bc-lts-java
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.73.0" }, { "fixed": "2.73.12" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "cpe": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "last_affected": "2.73.11" } ], "source": "CPE_RANGE" } ] }
Affected versions
Other
r2rv73dot0
r2rv73dot1
r2rv73dot10
r2rv73dot11
r2rv73dot3
r2rv73dot4
r2rv73dot6
r2rv73dot8
r2rv73dot9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59648.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"214220767692676017235281761043282671753",
"329307529904295921987627727812702075749",
"284772380863678601209379758195567871142",
"28638531881201617903859643105654099835"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-01234fa8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBESecretKeyDecryptorBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"210328564096370180978454999893852316922",
"234793716810047131512064100684792648146",
"331021078657164956308552399871484835976",
"171055320777872115915149386435246040952"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-039e18a9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBEDataDecryptorFactory.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"292584332287108137073178037231316209206",
"192296070898247715815141483593123143586",
"238964502261446498816853313733973604017",
"12843694787370904972693617120436164710",
"233672599842336668143091859515732311456",
"306356289106631066975185719969978912461",
"284772380863678601209379758195567871142",
"28638531881201617903859643105654099835"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-1967bd54",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEProtectionRemoverFactory.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"216329621582226460170023247355624469078",
"84523819374719903244097879738085775657",
"2417060392774660905137252122695283576",
"10409807724823723019954519765148463050",
"223800887513504745284612526622533737170",
"300294813110130983922132812477021927548",
"59755024658966075863833137245660928840",
"15359933635176324609892934901300571227",
"330861808318691187299688325703216301938",
"170371366355406389479695104423586274760",
"81728636356111726872307077169135828089",
"165838904059807083493428039855798019198",
"267171319432096088906656435558416073803",
"80838735494097013050235262545861285970",
"208935406259497239833115182217954212108",
"163696352653615479567621916672150049810",
"209095622729945388066476662935792052885",
"269560857663791686628989835255856866652",
"39056626127533183696717665645446297816",
"125160853589555680386105264283355987190",
"149959868505895215392895614057382337539",
"169159152342099384577149471451497130743",
"68845052232160455446522561383540291431",
"268708640808556508742445919838560113413",
"106674500922921575886131844463256165227",
"321240270300195887893322613467734468225",
"322932745999633098479216591459817148046",
"248647001672838790846903010555506383739",
"248894203138709560386918303825225467098",
"260559224084144177423821007911808741029",
"28740410469307062567846463728082779871",
"173375896527116221981630779273684212803",
"12578887130128879761832832589319211919",
"151623791442105495001266773304000007069",
"188317824257558144485995548316806078678",
"86758299629100365988762661772168353747",
"6421032407608877566095897144117499354"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-2d12c20e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PGPUtil.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206011660065918788838256202825063372522",
"length": 148
},
"id": "CVE-2026-59648-2fafe441",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBEDataDecryptorFactory.java",
"function": "makeKeyFromPassPhrase"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83857371088764759739626954315954908898",
"183184575413112946514028920079620924113",
"42468797803273906858359666317568605185",
"137632212618732884699895258342670162179",
"339258209874026940188255108875067211556",
"214353681607034423769579575310835802404",
"3379211072715695429256946229667788864",
"176870264482779729318701961178467432671",
"281250991614310586544839945550815037187",
"337424608373500477025021919782722836944",
"158568367627299129716997826018405370749",
"282919044614029052536363357021901763388"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-3a8eee99",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBESecretKeyDecryptor.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "246434382116734680406686184615457981304",
"length": 370
},
"id": "CVE-2026-59648-40507815",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/params/Argon2Parameters.java",
"function": "Builder"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154060450138732772684778781861314211726",
"length": 128
},
"id": "CVE-2026-59648-45d86315",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBESecretKeyEncryptor.java",
"function": "getKey"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41467232301602962963076424696100960235",
"length": 861
},
"id": "CVE-2026-59648-584fec16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcAEADSecretKeyEncryptorBuilder.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"190515509728780481696605833621111104072",
"238227596471861911965660674151463614794",
"195693804872182478875150769517730826143",
"184357900558697603325578635868547289083"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-7fe9d14d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcAEADSecretKeyEncryptorBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "85199540576766808034202155868994324793",
"length": 885
},
"id": "CVE-2026-59648-8107f85a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaAEADSecretKeyEncryptorBuilder.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "211029025121060407645649456119372262441",
"length": 103
},
"id": "CVE-2026-59648-86e78d37",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBEKeyEncryptionMethodGenerator.java",
"function": "PBEKeyEncryptionMethodGenerator"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "66577948410298980381849605915909325099",
"length": 266
},
"id": "CVE-2026-59648-89869c0e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/test/java/org/bouncycastle/openpgp/test/AllTests.java",
"function": "suite"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"188162815119907185666856231757936369621",
"144587097565315741092760739933203285432",
"272491055043450379683828982945088746898",
"209295094523770167798503265654228894465",
"41791198320042967299546009369733924344",
"167273547644065018484428627282738392166",
"289424198406027289628635618945483250593",
"237935969811847936758499681677970856963"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-90863597",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/params/Argon2Parameters.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"20282902225570802462811830696102814019",
"267690662837648188395493170793191757605",
"151078626892907556432684589773507147370",
"165403216701531275430051385207434580669"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-9ee0d031",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/test/java/org/bouncycastle/openpgp/test/AllTests.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"237418742935058177495658709590675908239",
"142493346432238272727189852748863173578",
"278309318121068160562627157337844818919",
"151013811516119144707654799348497646428",
"263743092735567096571917550998024353718",
"314302562465321850450127131069960625417",
"201570838081156617088467617740823688382",
"183384576911333795073231286408271649430",
"301596140475660107030720218743309711637",
"97014827495377432517718176923571731471",
"252758985410153688033614343573348536721",
"174978447892536732783029613088867167965",
"157548551555735448317068193322198472618",
"147241365128664497716896613466681403564",
"323712262651877039136290593004306391847"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-9f01985c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBEKeyEncryptionMethodGenerator.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"329024657618318283720493939300327419816",
"47574947468567810619939330716289953357",
"32851708283773166581054970698302173708",
"192179882616314378151652049363979600217"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-ab8cb939",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBEKeyEncryptionMethodGenerator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "149259198008528473574082388638747838366",
"length": 2980
},
"id": "CVE-2026-59648-bd3cc6be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEProtectionRemoverFactory.java",
"function": "createDecryptor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313071098351328689250769801349366934343",
"length": 216
},
"id": "CVE-2026-59648-bdb3e049",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBESecretKeyEncryptor.java",
"function": "PBESecretKeyEncryptor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116883406487995385471233555058914964946",
"length": 3216
},
"id": "CVE-2026-59648-cded5ec6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PGPUtil.java",
"function": "makeKeyFromPassPhrase"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"228164510103016707300042064591583572751",
"288237469311809155832841737692567536986",
"340006344018133692916357940298579400775",
"213306110556671949119884020232972642443"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-d4df66b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaAEADSecretKeyEncryptorBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "62056538385834203753972502036586132089",
"length": 338
},
"id": "CVE-2026-59648-d5670c63",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PGPUtil.java",
"function": "makeKeyFromPassPhrase"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"312350548344277583609710761326683038065",
"184394826688766292835365137044679587173",
"245607405447210326828210663941559264102",
"217549524033755137796488824162543390543"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-d7320e11",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEKeyEncryptionMethodGenerator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206011660065918788838256202825063372522",
"length": 148
},
"id": "CVE-2026-59648-dd31ea73",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBESecretKeyDecryptor.java",
"function": "makeKeyFromPassPhrase"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"322241952634942075799614580164554099253",
"66476219534393954160508541883682629427",
"94620317315517057603455610547708231076"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-e22c30ee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PGPSecretKeyDecryptorWithAAD.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "55885528362032711975784115620464427467",
"length": 348
},
"id": "CVE-2026-59648-e44ad08c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBEKeyEncryptionMethodGenerator.java",
"function": "getKey"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178777647399658845179159910938491290532",
"69951253055476802160453497391456988483",
"129215294603935273438029891908841301698",
"288444934759705347934797894172921461880"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-e574ebd3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEDataDecryptorFactoryBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "231746727159970861576904640585328336103",
"length": 3730
},
"id": "CVE-2026-59648-e89974d2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEDataDecryptorFactoryBuilder.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"247422809274589957759709904200131858166",
"46182885497147968185260898728903081230",
"163851366769624917882183469708621524917",
"188044966548628988030851776006686734790",
"202845012722870953797500329331797313447",
"113261784131144615603913050054066256162",
"271199590835003549246500825266411269467",
"60312975381860822205189886933185030730",
"23522200741700305884011674920160965104",
"135660369319043495991247882909149740563",
"89784190819006825299105249007212357286",
"165140471746184702263527223664127937908",
"35348847492667455133733061889870095237",
"207590447102017742234625504621846417427",
"24549253545265071810401655926399931052",
"178806001760230031473997438932704185157",
"153649438007071073032181611215600985018"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-f00fcd52",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBESecretKeyEncryptor.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "338208369557473359955718436584595260736",
"length": 1517
},
"id": "CVE-2026-59648-f59c916b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBESecretKeyDecryptorBuilder.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "106804682150768889573353082053095712382",
"length": 893
},
"id": "CVE-2026-59648-fba7b729",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBESecretKeyDecryptorBuilder.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"70804316308392689646520209268834002696",
"33998828328898474538284789825899908802",
"327028857356625879523091032681485926066",
"28638531881201617903859643105654099835"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-fe5c0735",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBESecretKeyDecryptorBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246477608560816573225585522207468977854",
"333826235842602990654983198974533644134",
"296125074856648480544812623275063437383",
"246462665583383517168418757390437828559",
"73195704567434017550502761789982039403",
"214353681607034423769579575310835802404",
"12714399978249746557402327766570482529",
"2635773757416129417258147269306139950",
"281250991614310586544839945550815037187",
"337424608373500477025021919782722836944",
"92217627973475749005100134284672468227",
"278267321732882217466927999179854377261"
],
"threshold": 0.9
},
"id": "CVE-2026-59648-fefe7fd8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/c915cc3f7a8d58f5ea2f88f01dfef2d402dd0799",
"target": {
"file": "pg/src/main/java/org/bouncycastle/openpgp/operator/PBEDataDecryptorFactory.java"
}
}
]
vanir_signatures_modified
"2026-10-28T10:55:42Z"