SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-58059

HIGH · CVSS 8.7 EPSS 0.35% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-03 · Last synced 2026-09-02

CyberRota Analysis

AI-Generated

Bouncy Castle for Java versions prior to 1.85, as well as specific LTS and FIPS releases, are vulnerable to quadratic-time escaping issues when processing X.500 distinguished names. This vulnerability can lead to performance degradation and potential denial-of-service conditions due to excessive resource consumption. Organizations utilizing affected versions of Bouncy Castle in their Java applications should prioritize patching to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-58059
Severity
HIGH
CVSS
8.7
EPSS
0.35%
Java

Original NVD Description

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).