# OPENSUSE-SU-2026:22169-1: bouncycastle security update

OPENSUSE-SU-2026:22169-1, released November 7, 2026, fixes 14 CVEs in bouncycastle (version 1.86-160000.1.1). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-22169-1
- Platform: Linux
- Released: Nov 7, 2026
- Priority: High (Closes CVE-2026-17507, high severity)
- CVEs: 14, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:22169-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bouncycastle](https://patchblox.com/security/data/product/linux/bouncycastle.md) | opensuse-leap 16.0 | 1.86-160000.1.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-17507](https://patchblox.com/security/data/cve/CVE-2026-17507.md) | High | bouncycastle: This update for bouncycastle fixes the following issues:  - CVE-2026-17507: negative signed leaf_index values from un... | 7.5 | 0.0042 |  |
| [CVE-2026-17508](https://patchblox.com/security/data/cve/CVE-2026-17508.md) | Routine | bouncycastle: This update for bouncycastle fixes the following issues:  - CVE-2026-17507: negative signed leaf_index values from un... | n/a | 0.0042 |  |
| [CVE-2026-18036](https://patchblox.com/security/data/cve/CVE-2026-18036.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose referenc... | n/a | 0.0028 |  |
| [CVE-2026-97873](https://patchblox.com/security/data/cve/CVE-2026-97873.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families... | n/a | 0.0026 |  |
| [CVE-2026-71890](https://patchblox.com/security/data/cve/CVE-2026-71890.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycas... | n/a | 0.0025 |  |
| [CVE-2026-71885](https://patchblox.com/security/data/cve/CVE-2026-71885.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.... | n/a | 0.0020 |  |
| [CVE-2026-71891](https://patchblox.com/security/data/cve/CVE-2026-71891.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every Basi... | n/a | 0.0017 |  |
| [CVE-2026-71892](https://patchblox.com/security/data/cve/CVE-2026-71892.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycast... | n/a | 0.0017 |  |
| [CVE-2026-71886](https://patchblox.com/security/data/cve/CVE-2026-71886.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or... | n/a | 0.0017 |  |
| [CVE-2026-71889](https://patchblox.com/security/data/cve/CVE-2026-71889.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPa... | n/a | 0.0017 |  |
| [CVE-2026-85515](https://patchblox.com/security/data/cve/CVE-2026-85515.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and... | n/a | 0.0016 |  |
| [CVE-2026-71888](https://patchblox.com/security/data/cve/CVE-2026-71888.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgo... | n/a | 0.0011 |  |
| [CVE-2026-18040](https://patchblox.com/security/data/cve/CVE-2026-18040.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmet... | n/a | 0.0011 |  |
| [CVE-2026-71887](https://patchblox.com/security/data/cve/CVE-2026-71887.md) | Routine | bouncycastle: In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey... | n/a | 0.0009 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.