Linux · openSUSE Leap · Security advisory · November 7, 2026

OPENSUSE-SU-2026:22169-1: bouncycastle security update

OPENSUSE-SU-2026:22169-1, released November 7, 2026, fixes 14 CVEs in bouncycastle (version 1.86-160000.1.1). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Highest CVSS
7.5
Base score, 0 to 10
Highest EPSS
0.0042
36th percentile

Priority of the 14 CVEs

Patch now 0 Urgent 0 High 1 Routine 13

Fixed package versions

ProductReleaseFixed in
bouncycastleopensuse-leap 16.01.86-160000.1.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-17507 bouncycastle: This update for bouncycastle fixes the following issues: - CVE-2026-17507: negative signed leaf_index values from un...7.5 0.0042 None reported
Routine CVE-2026-17508 bouncycastle: This update for bouncycastle fixes the following issues: - CVE-2026-17507: negative signed leaf_index values from un...n/a 0.0042 None reported
Routine CVE-2026-18036 bouncycastle: In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose referenc...n/a 0.0028 None reported
Routine CVE-2026-97873 bouncycastle: In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families...n/a 0.0026 None reported
Routine CVE-2026-71890 bouncycastle: In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycas...n/a 0.0025 None reported
Routine CVE-2026-71885 bouncycastle: In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X....n/a 0.0020 None reported
Routine CVE-2026-71891 bouncycastle: In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every Basi...n/a 0.0017 None reported
Routine CVE-2026-71892 bouncycastle: In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycast...n/a 0.0017 None reported
Routine CVE-2026-71886 bouncycastle: In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or...n/a 0.0017 None reported
Routine CVE-2026-71889 bouncycastle: In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPa...n/a 0.0017 None reported
Routine CVE-2026-85515 bouncycastle: In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and...n/a 0.0016 None reported
Routine CVE-2026-71888 bouncycastle: In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgo...n/a 0.0011 None reported
Routine CVE-2026-18040 bouncycastle: In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmet...n/a 0.0011 None reported
Routine CVE-2026-71887 bouncycastle: In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey...n/a 0.0009 None reported
Showing 1 to 14 of 14 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.