PatchTheCVE: bcpg-fipshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-12817: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned datahttps://patchthecve.com/cve/CVE-2026-12817.htmlhttps://patchthecve.com/cve/CVE-2026-12817.htmlMon, 31 Aug 2026 15:16:42 +0000HIGH 8.6: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).CVE-2026-59649: In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memoryhttps://patchthecve.com/cve/CVE-2026-59649.htmlhttps://patchthecve.com/cve/CVE-2026-59649.htmlWed, 02 Sep 2026 14:26:57 +0000HIGH 7.5: In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X sCVE-2026-59648: In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passeshttps://patchthecve.com/cve/CVE-2026-59648.htmlhttps://patchthecve.com/cve/CVE-2026-59648.htmlFri, 28 Aug 2026 19:40:16 +0000MEDIUM 5.3: In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).CVE-2026-59643: In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignoredhttps://patchthecve.com/cve/CVE-2026-59643.htmlhttps://patchthecve.com/cve/CVE-2026-59643.htmlThu, 10 Sep 2026 19:02:52 +0000HIGH 7.5: In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.CVE-2026-59640: In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key pathshttps://patchthecve.com/cve/CVE-2026-59640.htmlhttps://patchthecve.com/cve/CVE-2026-59640.htmlFri, 28 Aug 2026 15:40:23 +0000MEDIUM 5.3: In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X ser