This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-59651 →
DEBIAN-CVE-2026-59651
In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Ja...
Original description
The description as published by the source.
In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
bouncycastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
bouncycastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
bouncycastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.86-1"}]}]
References
- advisory security-tracker.debian.org