PatchTheCVEfips java api vulnerabilities and fixes
Recent CVEs affecting fips java api, with upgrade or downgrade steps. 9 tracked.
Also searched as: fipsjavaapi.
fips java api has 9 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-08-03. Highest priority: CVE-2026-8763 (score 46/100).
- CVE-2026-58063 MEDIUM 5.3 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file
- CVE-2026-58062 CRITICAL 9.1 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certifica
- CVE-2026-58061 HIGH 7.5 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check
- CVE-2026-58060 HIGH 7.5 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verif
- CVE-2026-58059 HIGH 7.5 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names
- CVE-2026-8763 CRITICAL 9.1 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI
- CVE-2026-14682 HIGH 7.5 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length re
- CVE-2026-13586 HIGH 7.5 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
- CVE-2026-13506 HIGH 7.5 UPGRADE UPGRADE In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard
FAQ
How do I fix fips java api vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fips java api being exploited right now?
None of the tracked fips java api CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fips java api CVE should I patch first?
CVE-2026-8763 currently ranks highest (46/100): In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI.