CVE-2026-58062 is a critical flaw (CVSS 9.1) in Bouncy Castle for Java. A stapled OCSP response is accepted without being bound to the certificate being checked, so a revoked certificate can pass. Upgrade to BC 1.85, BC-LTS 2.73.12, or BC-FJA bc-fips 2.0.2 or 2.1.3.
What's affected
- Bouncy Castle for Java before 1.85 (affected from 1.66).
- Bouncy Castle for Java LTS before 2.73.12.
- Bouncy Castle FIPS Java API (BC-FJA) before bc-fips 2.0.2 in the 2.0.X series and before 2.1.3 in the 2.1.X series.
- Platform: Java 8 and later, per the project wiki.
How to check if you're exposed
List the Bouncy Castle artifacts in your build. With Maven run mvn dependency:tree -Dincludes=org.bouncycastle. With Gradle run ./gradlew dependencies and search the output for bouncycastle. Check shaded or bundled copies inside fat JARs too.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade to the fixed version for your product line.
- Rebuild and redeploy every application that bundles Bouncy Castle.
- Check fat JARs and container images for older embedded copies.
- If you cannot upgrade yet, do not rely on stapled OCSP responses alone for revocation decisions.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
The project wiki explains the cause. In ProvOcspRevocationChecker, the stapled path verifies the response signature, then looks for a response entry matching the certificate. If none matches, the method returns without throwing, so the certificate is treated as not revoked and no CRL fallback happens. The network fetch path enforces this match, but the stapled path left it out. This is CWE-295 (Improper Certificate Validation).
The wiki says a TLS server holding a revoked certificate could staple a valid response for a different serial from the same CA and pass the check on a client built on Bouncy Castle. The CISA KEV flag is false.
Revocation is the safety net that lets a CA say a certificate must no longer be trusted. OCSP stapling lets a server attach a recent signed answer so the client need not ask the CA itself. That is faster and more private, but it moves a duty onto the client: confirm that the answer is about the certificate in front of you. This flaw is the client skipping that confirmation.
The practical effect is narrow but real. An attacker needs a revoked certificate that is still presented in a handshake, plus a valid signed response for some other certificate from the same CA. The client then treats the revoked one as fine. Applications that rely on Bouncy Castle for certificate path validation, such as custom TLS clients, service meshes written in Java or document signing checks, are where to look first.
Bouncy Castle appears as a direct dependency in some projects and as a transitive one in many others, often through libraries for PGP, S/MIME or JWT handling. A dependency tree, not a search of your own pom, is the reliable way to find it. Bundled copies inside application servers and shaded JARs are the usual blind spot.
The maintainers published fixed versions for three product lines, so the right target depends on which line you use. Do not mix lines: the FIPS build has its own version numbers, and a swap between lines should go through your normal compliance review.
Try it yourself
Bouncy Castle is a transitive dependency in many projects. This demo shows how reachability helps you decide what to patch first.
Click through it at your own pace, or open it full screen.
Quick check
Who is affected: the server or the client?
The checking side. A Java client or service that validates certificates with Bouncy Castle and stapled OCSP responses.
Is there a fix commit?
Yes. The wiki points to commit add5f82. Use the release versions above rather than patching by hand.
Sources
Last reviewed: 19 October 2026.
