CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate

Description

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 30% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BC

BC-FJA · Legion of the Bouncy Castle Inc.

2.0.0 before 2.0.2; 2.1.0 before 2.1.3 · source: vendor

BC

BC-JAVA · Legion of the Bouncy Castle Inc.

1.66 before 1.85 · source: vendor, NVD

BC

BC-LTS-JAVA · Legion of the Bouncy Castle Inc.

2.73.0 before 2.73.12 · source: vendor

BC

Bouncy Castle For Java Lts · Bouncycastle

through 2.73.11 · source: NVD

FJ

Fips Java Api · Bouncycastle

before 2.0.2; 2.1.0 before 2.1.3 · source: NVD