Is CVE-2026-59646 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59646 being exploited in the wild.

How severe is CVE-2026-59646?

High severity, with a CVSS score of 7.5, published 3 August 2026.

Which products and versions are affected?

Bouncy Castle for Java before 1.85; Bouncy Castle for Java FIPS (bctls-fips) 1.0.x before 1.0.24, 2.0.x before 2.0.24, 2.1.x before 2.1.24.

Is there a fix for CVE-2026-59646?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59646 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59646?

Check whether you run Bouncy Castle for Java or Bouncy Castle for Java FIPS (bctls-fips) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59646: Bouncy Castle DTLS handshake buffer overflow

CVE-2026-59646 · Severity: high · CVSS 7.5 · Published 2026-08-03

Bouncy Castle is a widely-used cryptographic library that handles secure communications, including DTLS (Datagram TLS) handshakes. A flaw in the DTLS handshake reassembler fails to validate a 24-bit length field, allowing an attacker to trigger a buffer overflow and potentially crash the application or execute arbitrary code on systems using affected versions.

Technologies: Bouncy Castle for Java. Vendors: Bouncy Castle.

Quick answers

Is CVE-2026-59646 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59646 being exploited in the wild.
How severe is CVE-2026-59646?: High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?: Bouncy Castle for Java before 1.85; Bouncy Castle for Java FIPS (bctls-fips) 1.0.x before 1.0.24, 2.0.x before 2.0.24, 2.1.x before 2.1.24.
Is there a fix for CVE-2026-59646?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59646 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59646?: Check whether you run Bouncy Castle for Java or Bouncy Castle for Java FIPS (bctls-fips) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the DTLS handshake reassembler component of Bouncy Castle for Java, which does not properly validate a 24-bit length field before allocating memory for buffers. An attacker can craft a malicious DTLS handshake message with an unchecked length value to cause a heap buffer overflow. This requires network access to a service using the affected library, no authentication is required. The flaw affects Bouncy Castle for Java before 1.85, Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (bctls-fips) versions 1.0.x before 1.0.24, 2.0.x before 2.0.24, and 2.1.x before 2.1.24. Patches are available in the fixed versions.

Affected products

Bouncy Castle Bouncy Castle for Java before 1.85
Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle Bouncy Castle for Java FIPS (bctls-fips) 1.0.x before 1.0.24, 2.0.x before 2.0.24, 2.1.x before 2.1.24

Timeline

2026-08-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.