CVE-2026-59648 in Bouncy Castle for Java
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java versions prior to 1.85, including the LTS versions before 2.73.12 and FIPS variants before their respective patches, involves a critical weakness in the OpenPGP Argon2 Salt-and-Key Processing implementation. This flaw allows attackers to manipulate memory parameters and passes during the key derivation process, fundamentally compromising the cryptographic security of encrypted data. The issue specifically affects the Argon2 S2K (String-to-Key) function which is used for deriving encryption keys from passwords in OpenPGP operations.
The technical root cause stems from inadequate validation of attacker-controlled parameters within the Argon2 implementation. When processing OpenPGP encrypted messages, the system accepts user-supplied memory consumption and iteration count values without proper bounds checking or sanitization. This vulnerability falls under CWE-129, representing improper validation of array indices, and more specifically aligns with CWE-347, which addresses improper certificate validation. The flaw enables an attacker to potentially reduce the computational cost of password cracking attacks by manipulating these parameters, effectively weakening the encryption strength significantly.
The operational impact of this vulnerability is severe as it directly undermines the security guarantees provided by OpenPGP encryption when using Argon2-based key derivation. Attackers can exploit this weakness to perform more efficient brute-force or dictionary attacks against encrypted data, potentially recovering passwords or keys much faster than expected. This issue affects systems relying on Bouncy Castle for secure email communications, file encryption, and any application that implements OpenPGP with Argon2 S2K functions. The vulnerability exists across multiple product lines including standard Bouncy Castle Java, LTS releases, and FIPS-certified versions, indicating a widespread exposure.
Mitigation strategies should prioritize immediate upgrade to patched versions of Bouncy Castle Java, specifically version 1.85 or later for standard releases, 2.73.12 or later for LTS versions, and appropriate FIPS versions. Organizations should conduct comprehensive vulnerability assessments to identify systems utilizing affected Bouncy Castle components and implement proper parameter validation controls. Additionally, security monitoring should be enhanced to detect anomalous usage patterns in cryptographic operations that might indicate exploitation attempts. The ATT&CK framework categorizes this issue under T1583.001 for Obtain Capabilities, as it represents a method for adversaries to weaken cryptographic protections through parameter manipulation attacks.