Reported by 4 outlets
Bouncy Castle BC-JAVA critical CVEs 2026-71885 and 2026-71887
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Critical CVE-2026-71885 affects Bouncy Castle BC-JAVA before version 1.86 in the messaging-layer security MLS RFC 9420 implementation; a separate CVE-2026-71887 covers improper verification of cryptographic signatures. The new Mastodon event from radar.offseq.com reinforces the advisory with a focus on CVE-2026-71885. EUVD database entries EUVD-2026-92002 and EUVD-2026-92003 also reference the same product and vendor but carry no new primary source detail.
There is no confirmed in-the-wild exploitation claim tied specifically to these CVEs in the event content. The advisory remains a critical cryptographic implementation flaw with a CVSS in the high range. Organizations using BC-JAVA messaging components should upgrade to version 1.86 or later and review any reliance on MLS or signature verification paths in Bouncy Castle.
Timeline
-
original reporting
CRITICAL CVE-2026-71885 in Bouncy Castle BC-JAVA ( https:// radar.offseq.com/threat/cve-20 26-71885-cwe-295-improper-certificate-validation-
radar.offseq.com · 10d ago · October 3rd, 2026
CRITICAL CVE-2026-71885 in Bouncy Castle BC-JAVA ( https:// radar.offseq.com/threat/cve-20 26-71885-cwe-295-improper-certificate-validation-
via Mastodon https://radar.offseq.com/threat/cve-2026-71885-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-13dda4ca65417833
-
update from radar.offseq.com
CVE-2026-71887 | Legion of the Bouncy Castle BC-JAVA https:// radar.offseq.com/threat/cve-20 26-71887-cwe-347-improper-verification-of-crypt
radar.offseq.com · 10d ago · October 3rd, 2026
CVE-2026-71887 | Legion of the Bouncy Castle BC-JAVA https:// radar.offseq.com/threat/cve-20 26-71887-cwe-347-improper-verification-of-crypt
via Mastodon https://radar.offseq.com/threat/cve-2026-71887-cwe-347-improper-verification-of-cryptographic-signature-in-legion-of-the-bouncy-castle-0eee2b4a5be9b093
-
update from euvd.enisa.europa.eu
🚨 EUVD-2026-92003 📊 Score: 9.2/10 (CVSS v3.1) 📦 Product: BC-JAVA 🏢 Vendor: Legion of the Bouncy Castle Inc. 📅 Updated: 2026-10-03 📝 In Bounc
euvd.enisa.europa.eu · 10d ago · October 3rd, 2026
🚨 EUVD-2026-92003 📊 Score: 9.2/10 (CVSS v3.1) 📦 Product: BC-JAVA 🏢 Vendor: Legion of the Bouncy Castle Inc. 📅 Updated: 2026-10-03 📝 In Bounc
via Mastodon https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92003
-
mentioned by euvd.enisa.europa.eu
🚨 EUVD-2026-92002 📊 Score: 8.2/10 (CVSS v3.1) 📦 Product: BC-JAVA 🏢 Vendor: Legion of the Bouncy Castle Inc. 📅 Updated: 2026-10-03 📝 In Bounc
euvd.enisa.europa.eu · 10d ago · October 3rd, 2026
-
update from radar.offseq.com
CVE-2026-71885 (CRITICAL): Bouncy Castle for Java https:// radar.offseq.com/threat/in-bou ncy-castle-for-java-before-186-the-messaging-layer
radar.offseq.com · 10d ago · October 4th, 2026
CVE-2026-71885 (CRITICAL): Bouncy Castle for Java https:// radar.offseq.com/threat/in-bou ncy-castle-for-java-before-186-the-messaging-layer
via Mastodon https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-messaging-layer-security-mls-rfc-9420-implementation-did-not-53cae24ecd925b00
-
update from deafnews.it
CVE-2026-71885: A flaw in X.509 certificate binding enables full identity impersonation in Bouncy Castle MLS encrypted groups. CVSS 9.2. Fix
deafnews.it · 9d ago · October 4th, 2026
CVE-2026-71885: A flaw in X.509 certificate binding enables full identity impersonation in Bouncy Castle MLS encrypted groups. Fix
via Mastodon https://deafnews.it/en/article/cve-2026-71885-identity-spoofing-in-bouncy-castle-mls-with-cvss-92
-
update from beyondmachines.net
Bouncy Castle Patches Identity Binding Vulnerability in Messaging Layer Security Implementation Bouncy Castle for Java patched a critical id
beyondmachines.net · 8d ago · October 5th, 2026
Bouncy Castle Patches Identity Binding Vulnerability in Messaging Layer Security Implementation Bouncy Castle for Java patched a critical id
via Mastodon https://beyondmachines.net/event_details/bouncy-castle-patches-identity-binding-vulnerability-in-messaging-layer-security-implementation-i-0-l-r-6/gD2P6Ple2L