CVE-2026-59651

A flaw was found in Bouncy Castle for Java. The BKS keystore, which is used for storing cryptographic keys, accepts legacy versions that utilize a 16-bit integrity Message Authentication Code (MAC) key. This weak integrity protection could allow an attacker to tamper with the keystore's contents without being detected, leading to a high integrity impact.

Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The BKS keystore accepts legacy-format keystores protected by only a 16-bit integrity MAC key, weakening tamper detection and allowing undetected modification of keystore contents — a high integrity impact. Exploitation requires the application to load legacy-format BKS keystores.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85 or LTS 2.73.12) once available for the affected product.