What is GHSA-jmxg-924w-f7mv?

GHSA-jmxg-924w-f7mv is a security advisory published by GitHub Security Advisories with Medium severity. In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from...

Which CVE IDs does GHSA-jmxg-924w-f7mv cover?

GHSA-jmxg-924w-f7mv covers the following CVE IDs: CVE-2026-58063. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-jmxg-924w-f7mvMedium

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from...

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-58063 →

📋 Description

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-58063
https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06
https://github.com/bcgit/bc-java/wiki/CVE-2026-58063
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058063
https://github.com/advisories/GHSA-jmxg-924w-f7mv