Get real-time updates on Telegram
CVE-2026-71885: BC-JAVA 0 to before 1.86
CVE-2026-71885. EPSS 0.00188 (percentile 0.07566), scored 05-Oct-2026. Fixed version: eacda831fbe15b272933e40841d8b0827b556fae. Fixed version: 77632a57edf350a7b5751fca1a5052daffa8dab2.
Affected technology
BC-JAVA · 0 to before 1.86
Legion of the Bouncy Castle Inc.
Description’s affected range: before 1.86
Component: mls
File: LeafNode
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
An unauthenticated attacker could be admitted under a victim's X.509 identity, evict the victim (resynchronization compares whole credentials rather than signing keys), derive the current epoch, decrypt subsequent group messages, and send messages accepted as the victim. Source advisory’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality and integrity impact as high; availability impact as low.
- CWE
- CWE-287, CWE-295
- CCR priority
- 0.0 /100 (P5)
- EPSS
- 0.00188 · percentile 0.07686 · 2026-10-11
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-11 23:42:05.235979+00:00 UTC
- GitHub Advisory Database · Source record · observed 2026-10-04 06:01:24.332572+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-06 17:55:17.257073+00:00 UTC
- OSV.dev · Source record · observed 2026-10-08 08:57:13.774521+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-71885.html