{ "cveId": "CVE-2026-59649", "url": "https://patchblox.com/security/cve/CVE-2026-59649", "summary": "CVE-2026-59649 is fixed in 48 products on 1 platform, first by DEBIAN-CVE-2026-59649, released August 3, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "eap8-activemq-artemis: In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory", "description": "In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).", "published": "2026-08-03T00:44:24Z", "severity": "important", "cvss": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00493, "epssPercentile": 0.4263, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bouncycastle", "release": "Debian 14", "fixedVersion": "1.86-1", "fix": "DEBIAN-CVE-2026-59649", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59649", "released": "2026-08-03T01:16:45Z" }, { "platform": "linux", "product": "bouncycastle", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "bouncycastle", "release": "opensuse-leap 16.0", "fixedVersion": "1.85-160000.1.1", "fix": "OPENSUSE-SU-2026:21538-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21538-1", "released": "2026-08-06T07:36:52Z" }, { "platform": "linux", "product": "bouncycastle", "release": "sles 15.6", "fixedVersion": "1.85-150200.3.38.1", "fix": "SUSE-SU-2026:3559-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3559-1", "released": "2026-08-10T18:04:57Z" }, { "platform": "linux", "product": "bouncycastle", "release": "sles 15.7", "fixedVersion": "1.85-150200.3.38.1", "fix": "SUSE-SU-2026:3559-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3559-1", "released": "2026-08-10T18:04:57Z" }, { "platform": "linux", "product": "bouncycastle", "release": "sles 16.0", "fixedVersion": "1.85-160000.1.1", "fix": "SUSE-SU-2026:23150-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23150-1", "released": "2026-08-06T07:40:53Z" }, { "platform": "linux", "product": "bouncycastle-javadoc", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "bouncycastle-mail", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "bouncycastle-pg", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "bouncycastle-pkix", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "bouncycastle-tls", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "bouncycastle-util", "release": "amzn 2023", "fixedVersion": "1.70-4.amzn2023.0.8", "fix": "ALAS2023-2026-2153", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2153", "released": "2026-09-14T09:00:00Z" }, { "platform": "linux", "product": "eap8-activemq-artemis", "release": "RHEL 10", "fixedVersion": "2.40.0-8.redhat_00024.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-apache-cxf", "release": "RHEL 10", "fixedVersion": "4.1.7-1.SP1_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-artemis-wildfly-integration", "release": "RHEL 10", "fixedVersion": "2.0.5-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-bouncycastle", "release": "RHEL 10", "fixedVersion": "1.85.0-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-cryptacular", "release": "RHEL 10", "fixedVersion": "1.2.7-1.redhat_00002.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-eap-product-conf-parent", "release": "RHEL 10", "fixedVersion": "801.8.0-1.GA_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-hibernate", "release": "RHEL 10", "fixedVersion": "6.6.54-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-httpcomponents-asyncclient", "release": "RHEL 10", "fixedVersion": "4.1.5-5.redhat_00008.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-ironjacamar", "release": "RHEL 10", "fixedVersion": "3.0.22-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-annotations", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-core", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-databind", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-dataformats-text", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-jaxrs-providers", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-modules-base", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jackson-modules-java8", "release": "RHEL 10", "fixedVersion": "2.18.9-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jakarta-xml-bind-api", "release": "RHEL 10", "fixedVersion": "4.0.5-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jaxb", "release": "RHEL 10", "fixedVersion": "4.0.7-4.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jaxbintros", "release": "RHEL 10", "fixedVersion": "2.1.0-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jboss-logging", "release": "RHEL 10", "fixedVersion": "3.6.3-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jboss-remoting", "release": "RHEL 10", "fixedVersion": "5.0.31-1.SP2_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-api", "release": "RHEL 10", "fixedVersion": "3.1.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-common-tools", "release": "RHEL 10", "fixedVersion": "2.2.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-cxf", "release": "RHEL 10", "fixedVersion": "7.4.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-jaxws-undertow-httpspi", "release": "RHEL 10", "fixedVersion": "3.0.1-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jbossws-spi", "release": "RHEL 10", "fixedVersion": "5.1.0-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-jsf-impl", "release": "RHEL 10", "fixedVersion": "4.0.11-2.SP1_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-log4j", "release": "RHEL 10", "fixedVersion": "2.25.4-1.redhat_00003.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-neethi", "release": "RHEL 10", "fixedVersion": "3.2.2-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-netty", "release": "RHEL 10", "fixedVersion": "4.1.136-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-netty-transport-native-epoll", "release": "RHEL 10", "fixedVersion": "4.1.136-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-nimbus-jose-jwt", "release": "RHEL 10", "fixedVersion": "9.37.4-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-parsson", "release": "RHEL 10", "fixedVersion": "1.1.9-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-saaj-impl", "release": "RHEL 10", "fixedVersion": "3.0.6-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-slf4j", "release": "RHEL 10", "fixedVersion": "2.0.18-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-undertow", "release": "RHEL 10", "fixedVersion": "2.3.26-2.SP3_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-wildfly", "release": "RHEL 10", "fixedVersion": "8.1.8-9.GA_redhat_00006.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-wildfly-elytron", "release": "RHEL 10", "fixedVersion": "2.6.11-1.Final_redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-wildfly-javadocs", "release": "RHEL 10", "fixedVersion": "8.1.1-12.GA_redhat_00048.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-ws-commons-XmlSchema", "release": "RHEL 10", "fixedVersion": "2.3.2-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" }, { "platform": "linux", "product": "eap8-xml-security", "release": "RHEL 10", "fixedVersion": "3.0.6-1.redhat_00001.1.el10eap", "fix": "RHSA-2026:70230", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-70230", "released": "2026-09-23T19:20:59Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T19:12:23Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }