Is CVE-2026-59645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59645 being exploited in the wild.

How severe is CVE-2026-59645?

High severity, with a CVSS score of 7.5, published 3 August 2026.

Which products and versions are affected?

Bouncy Castle for Java before 1.85; Bouncy Castle for Java FIPS (bcutil-fips) 2.0.X before 2.0.7, 2.1.X before 2.1.7.

Is there a fix for CVE-2026-59645?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Am I affected by CVE-2026-59645?

Check whether you run Bouncy Castle for Java or Bouncy Castle for Java FIPS (bcutil-fips) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59645: Bouncy Castle for Java OER parser unbounded recursion in IEEE 1609.2 schema

CVE-2026-59645 · Severity: high · CVSS 7.5 · Published 2026-08-03

Bouncy Castle for Java is a widely-used cryptographic library that processes digital certificates and protocol messages for security applications. An attacker can craft a malicious message using the IEEE 1609.2 schema format that causes the OER parser to recurse indefinitely, exhausting memory and crashing the application, resulting in a denial-of-service attack against any service using this library.

Technologies: Bouncy Castle for Java. Vendors: Bouncy Castle.

Quick answers

Is CVE-2026-59645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59645 being exploited in the wild.
How severe is CVE-2026-59645?: High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?: Bouncy Castle for Java before 1.85; Bouncy Castle for Java FIPS (bcutil-fips) 2.0.X before 2.0.7, 2.1.X before 2.1.7.
Is there a fix for CVE-2026-59645?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-59645?: Check whether you run Bouncy Castle for Java or Bouncy Castle for Java FIPS (bcutil-fips) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack overflow / denial-of-service issue in the OER (Octet Encoding Rules) parser when processing self-referential schemas defined in IEEE 1609.2 (a standard for vehicular communications). The parser lacks depth-limiting safeguards and will recurse without bound on specially crafted input containing circular schema references. An attacker can send a network packet or malicious serialized object containing a self-referential IEEE 1609.2 schema to any application parsing untrusted OER-encoded data. No authentication is required; network accessibility to the vulnerable parser is the primary precondition. Successful exploitation causes denial-of-service through resource exhaustion. Patches are available: upgrade to Bouncy Castle for Java 1.85+, Java LTS 2.73.12+, or BC-FJA bcutil-fips 2.0.7 (2.0.X) / 2.1.7 (2.1.X).

Affected products

Bouncy Castle Bouncy Castle for Java before 1.85
Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle Bouncy Castle for Java FIPS (bcutil-fips) 2.0.X before 2.0.7, 2.1.X before 2.1.7

Timeline

2026-08-03: disclosed: CVE-2026-59645 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.