Bouncy Castle Java FIPS 2.1.X release notes

This article includes the release notes for both the bc-fips modules and also the associated APIs.

For commercial support and early access to later releases, please contact us at Keyfactor Bouncy Castle Support. If you would like to donate to support this effort please see our donations page.

0 Notes

It should be possible to use the associated 2.1.* APIs can be used with any version of the 2.1.* module.

1 bc-fips jar files

1.1 bc-fips-2.1.3.jar

Release Date: 19th July 2026

1.1.1 Defects fixed

1. CVE-2026-8149: when data was processed in chunks the native GCM implementation could produce a spurious bad-tag exception on decryption. This has been fixed.
2. CVE-2026-8798: a failure of the CPU entropy instructions (RDSEED/RDRAND) could cause the native RNG to loop indefinitely, leading to a potential denial of service. A retry limit has been added; a related compiler-directive fix ensures the mitigating operations are not optimised away.
3. CVE-2026-8763: name constraints could be bypassed via a trailing dot in an rfc822Name or URI. Name-constraint validation in PKIXNameConstraintValidator and the certificate path processing has been corrected.
4. CVE-2026-13506: forcing a lazily-evaluated ASN.1 sequence could reset the constructed-nesting-depth guard, allowing deeply nested crafted input to be recursed without limit. The nesting-depth guard is now preserved.
5. CVE-2026-58059: escaping of X.500 DN values in IETFUtils was quadratic in the length of the value, allowing a denial of service with a crafted value; it is now linear-time.
6. CVE-2026-14682: reading a definite-length ASN.1 object allocated the full declared length up front, so a short crafted header could force an OutOfMemoryError before any content was read. The working buffer now grows as bytes actually arrive.
7. CVE-2026-58060: the HSS depth (L) read on the LMS parse/verify path is now bounded per RFC 8554, preventing an attacker-supplied key from driving a large allocation.
8. CVE-2026-58061: for CCM the authentication tag is now verified before any decrypted plaintext is copied to the caller's output buffer.
9. CVE-2026-58062: OCSP revocation checking now fails (recoverably, so CRL fallback can still run) when no OCSP response binds to the certificate being checked, rather than accepting a signed-but-unrelated response; associated CRL-cache contention was also addressed.
10. CVE-2026-58063: the KDF cost (PBKDF2 iteration count / scrypt memory) used for the BCFKS integrity check is now bounded before the MAC is verified, preventing a pre-authentication denial of service on load.
11. CVE-2026-13586: the PKCS#12 keystore MAC and bag-decryption KDF iteration counts are now bounded on load, preventing a pre-authentication denial of service.
12. CVE-2026-13505: key material is zeroized on garbage collection, but on later JVMs the finalizer-based disposal could contribute to an OutOfMemoryError. Zeroization of the AES/DESede engines, the SP800-90A DRBGs, symmetric secret keys and the PBKD/scrypt parameters now uses java.lang.ref.Cleaner on Java 9 and later.
13. X9.31 is now explicitly blocked in the low-level API when running in approved-only mode (it was already blocked at the JCA layer), in line with the latest IG guidance.
14. The DSTU4145 range check now covers the full range of the group rather than simply truncating the top bit.

1.1.2 Additions

1. The system/security property org.bouncycastle.asn1.max_limit can be set to impose an explicit per-object length ceiling on ASN.1 parsing (a plain byte count, or a value with a "k", "m" or "g" suffix) when wrapping a raw input stream.
2. The system/security property org.bouncycastle.x509.crl.cache.ttl can be set to an optional maximum lifetime, in seconds, for a CRL cached from a distribution point.
3. The keystore KDF/MAC cost limits can be tuned via the system/security properties org.bouncycastle.bcfks.max_iterations, org.bouncycastle.bcfks.max_scrypt_memory and org.bouncycastle.pkcs12.max_it_count.
4. The BCFKS keystore now fails early with a warning when an unusually short password is supplied.

1.2 bc-fips-2.1.2.jar

Release Date: 22nd September 2025

1.2.1 Defects fixed

1. CVE-2025-12194: while the situation with the JVM garbage collector overrun for Java 17 and Java 21 greatly improved with the changes in 2.1.1, we've still had some reports that can only be related to the use of the disposal daemon. The disposal code for Java 9 and later has now been rewritten to use reachability fencing, which allows the disposal code to now free up native resources without delay leading to much more reliable performance.
2. The jar now contains multiple checksums which will allow it to be used with jlink providing the JVM involved does not require signed providers. Note: this feature is not cleared as FIPS compliant (yet).
3. The CertPath processing would eliminate certificates on the basis of mismatched KeyIds. This behaviour has been corrected in line with RFC 4158, Section 3.5.12 to ignore the KeyId in case of mismatch.
4. A missing provider reference in the PKCS#12 KeyStore code could cause an UnknownAlgorithmException to be thrown on key extraction when the BCFIPS provider was not explicitly installed in the JVM's provider list. This has been fixed.

1.2.2 Additions

1. Where a delay is needed between GC flagging and final disposal of native resources the system/security property org.bouncycastle.native.cleanup_delay can be set to non-zero (the default is zero). The number given is considered to be seconds unless followed by the string "ms", in which case it is read as milli-seconds.
2. It is now possible to set the priority of the native disposal thread using the system/security property org.bouncycastle.native.cleanup_priority. Settings can be "min", "normal", or "high". The default setting is "min".

1.3 bc-fips-2.1.1.jar

Release Date: 2nd August 2025

1.3.1 Defects fixed

1. In multi-JVM environments BC-FJA 2.1.0 could be found to create many directories for the .so files required for native support. The 2.1.1 release includes the system/security property "org.bouncycastle.native.loader.install_dir" which allows a user to specify where the .so files should be found. If the directory does not exist initially the .so files will be installed in the install_dir and further invocations will check them for correctness and use them instead of creating their own copies. The .so files go into a versioned sub-directory to avoid issues with updating to new versions of the provider.
2. The JCE Cipher.doFinal() which takes input and output arrays can accidently overwrite input where the two arrays are the same and the output is offset to a different value from the input offset. This has been fixed.
3. Ed448 and Ed25519 were being dropped from the JCA provider when it was created with the org.bouncycastle.fips.approved_only set to true. This has been fixed.
4. LMS for signature verification was being dropped from the JCA provider when it was created with the org.bouncycastle.fips.approved_only set to true. This has been fixed.
5. The use of a private instance class, rather than a private static class in the AESNativeCBC class appears to be causing some garbage collectors to fail to collect native CBC ciphers when no longer in use. The class has now been made static and it appears this has resolved the garbage collection problem where it was reported.

1.4 bc-fips-2.1.0.jar

Release Date: 25th January 2025

The initial 2.1.0 release forked from BC-FJA 2.0.0, any chages and fixes should be viewed as relative to that release. Please see BC-FJA-KnownIssues-2.1.0.csv for the list of known issues with this release.

1.4.1 Additions and enhancements

1. RSA, DSA, ECDSA, EDDSA are now compliant and tested with FIPS 186-5.
2. The range of digest algorithms available with SSH KDF has been increased.
3. The LMS/HSS algorithm has been added (verification only in approved mode).
4. Adds support for Intel AES-NI, SHA-256, and native RNG/DRBG where the operational environment otherwise supports it.

1.4.2 Defects fixed

1. BC-FJA-2.0.0-01 - Jar now includes multi-release support suitable for OSGI.

2 bcutil-fips jar files

2.1 bcutil-fips-2.1.7.jar

Release Date: TBD General BC Baseline: 1.85

2.1.1 Defects fixed

1. CVE-2026-59645 The OER parser used for IEEE 1609.2 (ITS) structures now enforces a recursion depth limit, preventing stack exhaustion from a self-referential schema.

2.2 bcutil-fips-2.1.5.jar

Release Date: 22nd September 2025 General BC Baseline: 1.82

2.2.1 Additions

1. Additional structures from BC Java 1.82.

3 bcpkix-fips jar files

3.1 bcpkix-fips-2.1.12.jar

Release Date: TBD General BC Baseline: 1.85

3.1.1 Defects fixed

1. CVE-2026-12802 CMS AuthEnvelopedData decryption now enforces the authentication tag length on decryption.
2. The PKCS#8 and PBES2 input decryptors now bound the scrypt and PBKDF2 KDF cost parameters taken from the encrypted structure rather than honouring unbounded values from the input (CVE-2026-15055).
3. CVE-2026-59639 CMS signature verification no longer returns true for a SignedData with zero signers.
4. CVE-2026-59642 CMS AuthenticatedData content is now bound to the MAC when authenticated attributes are present.
5. CVE-2026-59647 CRMF / CMP password-based MAC now bounds the iteration count read from input.
6. The streaming S/MIME writers SMIMEEnvelopedWriter.Builder and SMIMESignedWriter.Builder (org.bouncycastle.mime.smime) emitted a caller-supplied header name and value verbatim through withHeader(). withHeader now rejects a name or value containing CR or LF; internally generated (folded) headers are unaffected.

3.2 bcpkix-fips-2.1.10.jar

Release Date: 22nd September 2025 General BC Baseline: 1.82

3.2.1 Additions

1. Added support for generating certificates and CRLs containing X.509 altSignature/subjectAltPublicKey extensions.
2. Added support for generating certificates containing DeltaCertificateDescriptor extensions.
3. Support has been added to the CMS content encryptors to allow a generated key to be passed in, rather than always having them generate their own.
4. Added optional support for use the BCPQC uncertified FIPS provider for certificates, CRLs, and CMS messages.

4 bctls-fips jar files

4.1 bctls-fips-2.1.24.jar

Release Date: TBD General BC Baseline: 1.85

4.1.1 Defects fixed

1. CVE-2026-59638 BCJSSE: the hostname verifier no longer enables CN-fallback by default; the documented opt-in is now required.
2. CVE-2026-59646 DTLS: the handshake reassembler now validates the 24-bit fragment length before allocating a buffer.

4.2 bctls-fips-2.1.22.jar

Release Date: 22nd September 2025 General BC Baseline: 1.82

4.2.1 Defects fixed

1. BCJSSE: Session binding map is now shared across all stages of the session lifecycle (SunJSSE compatibility).

4.2.2 Additions

1. BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.
2. BCJSSE: Added support for system properties "jdk.tls.client.maxInboundCertificateChainLength" and "jdk.tls.server.maxInboundCertificateChainLength".
3. BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00 where the BCPQC FIPS provider is present.

5 bcpg-fips jar files

5.1 bcpg-fips-2.1.13.jar

Release Date: TBD General BC Baseline: 1.85

5.1.1 Defects fixed

1. CVE-2026-12817 OpenPGP AEAD decryption no longer skips the final authentication tag on chunk-aligned data.
2. CVE-2026-59640 The OpenPGP CFB "quick check" oracle is no longer active on the symmetric / session-key paths.
3. CVE-2026-59643 OpenPGP inline-signature policy failures are no longer silently ignored.
4. CVE-2026-59648 The OpenPGP Argon2 S2K now bounds attacker-chosen memory parameters.
5. CVE-2026-59649 OpenPGP user-attribute subpacket length is now bounded rather than limited only by JVM max memory.

6 bcmail-fips jar files

6.1 bcmail-fips-2.1.7.jar

Release Date: TBD General BC Baseline: 1.85

6.1.1 Defects fixed

1. CVE-2026-59641 The S/MIME validator no longer trusts the signer-asserted signingTime when performing path validation.

7 bcjmail-fips jar files

7.1 bcjmail-fips-2.1.7.jar

Release Date: TBD General BC Baseline: 1.85

7.1.1 Defects fixed

1. CVE-2026-59641 The S/MIME validator no longer trusts the signer-asserted signingTime when performing path validation.