Bug 2510193 (CVE-2026-59646) - CVE-2026-59646 org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation
Summary: CVE-2026-59646 org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy ...
Keywords:
Status: NEW
Alias: CVE-2026-59646
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-03 02:01 UTC by OSIDB Bzimport
Modified: 2026-10-29 21:39 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:92858 0 None None None 2026-10-29 21:37:07 UTC
Red Hat Product Errata RHSA-2026:92859 0 None None None 2026-10-29 21:39:32 UTC
Red Hat Product Errata RHSA-2026:92860 0 None None None 2026-10-29 21:35:37 UTC

Description OSIDB Bzimport 2026-08-03 02:01:32 UTC 
In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
Comment 3 Jon Orris 2026-10-29 21:35:35 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:92860 https://access.redhat.com/errata/RHSA-2026:92860
Comment 4 Jon Orris 2026-10-29 21:37:05 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:92858 https://access.redhat.com/errata/RHSA-2026:92858
Comment 5 Jon Orris 2026-10-29 21:39:31 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:92859 https://access.redhat.com/errata/RHSA-2026:92859
Note You need to log in before you can comment on or make changes to this bug.