[GHSA-8rxj-3p7p-rq39] Bouncy Castle for Java JSSE hostname verifier enables CN fallback by default - #9574
Open
whostolebenfrog wants to merge 1 commit into
Conversation
Add a summary, the affected org.bouncycastle:bctls-* artifacts with version ranges from the vendor advisory, and a PACKAGE reference. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
github-actions
Bot
changed the base branch from
main
to
whostolebenfrog/advisory-improvement-9574
September 15, 2026 16:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
CVE-2026-59638 is currently unreviewed with no package data, so Dependabot and downstream scanners that consume this database (for example Docker Scout) cannot match it against the affected artifacts.
The vulnerable code is
org.bouncycastle.jsse.provider.HostnameUtil, which ships in thebctls-*artifacts rather thanbcprov-*. The fix commit bcgit/bc-java@799bd15 only changestls/src/main/java/org/bouncycastle/jsse/provider/HostnameUtil.java(plus its test and the ant build files).Version ranges follow the vendor advisory https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059638:
bctls-fips1.0.xbctls-fips2.0.xbctls-fips2.1.xPer-artifact lower bounds are the first versions published on Maven Central:
bctls-jdk18on1.71,bctls-jdk15to181.63,bctls-jdk141.61,bctls-debug-jdk18on1.73.bctls-jdk15onended at 1.70 with no fixed release, so it is recorded aslast_affected1.70; users need to move tobctls-jdk18onorbctls-jdk15to181.85.Also added a
PACKAGEreference to https://github.com/bcgit/bc-java.🤖 Generated with Claude Code