openSUSE-SU-2026:22169-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22169-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22169-1
Upstream
CVE (14)
Related
CVE (14)
Published
2026-10-26T13:05:47Z
Modified
2026-11-01T17:23:28Z
Summary
Security update for bouncycastle
Details

This update for bouncycastle fixes the following issues:

Update to 1.86:

  • CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion (bsc#1284075).
  • CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion (bsc#1284073).
  • CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing side-channel attacks (bsc#1284065).
  • CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel leaks (bsc#1284205).
  • CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation and group message interception (bsc#1284165).
  • CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust delegations and identity spoofing (bsc#1284212).
  • CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature misattribution and trust context spoofing (bsc#1284213).
  • CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause unauthenticated attribute injection (bsc#1284215).
  • CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name constraint bypasses (bsc#1284218).
  • CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member eviction and session takeover (bsc#1284219).
  • CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature verification bypasses (bsc#1284220).
  • CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses for HKDF-derived content keys (bsc#1284221).
  • CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered truncation errors and integrity check bypasses (bsc#1284222).
  • CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause resource exhaustion (bsc#1284224).
References

Affected packages

openSUSE:Leap 16.0 / bouncycastle

Package

Name
bouncycastle
Purl
pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.86-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "bouncycastle": "1.86-160000.1.1",
            "bouncycastle-javadoc": "1.86-160000.1.1",
            "bouncycastle-jmail": "1.86-160000.1.1",
            "bouncycastle-mail": "1.86-160000.1.1",
            "bouncycastle-pg": "1.86-160000.1.1",
            "bouncycastle-pkix": "1.86-160000.1.1",
            "bouncycastle-tls": "1.86-160000.1.1",
            "bouncycastle-util": "1.86-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22169-1.json"