Repository navigation
[CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs #48570
Description
Bouncy castle reported several vulnerabilities that are fixed in version 1.84
- CVE‐2026‐0636
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636 - CVE‐2026‐3505
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505 - CVE‐2026‐5598
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598
There is no severity score assigned by the BC team.
Activity
[-][CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5588, CVE‐2026‐5598] Multiple bouncycastle CVEs[/-][+][CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs[/+]ahus1 commentedon Apr 29, 2026
@mposolda - can your team please look into upgrading bouncy castle? This is usually already related to FIPS.
There are some more BC security alerts in #48275, which would be fixed by the same upgrade.
mposolda commentedon May 4, 2026
@ahus1 As mentioned by @mabartos in #48275 , we probably cannot do much here as we rely on the BC versions provided by quarkus.
Just for BC-FIPS, we control the versions in our
pom.xmlas those cannot be bundled with Quarkus. But for BC-FIPS, we use version 2, which is not affected by the CVEs reported above.Can we close this issue? Or can I re-assign to cloud-native team as that is the team responsible for upgrading quarkus?
9 remaining items
Upgrade to Quarkus 3.33.1.1 (keycloak#48688)
Upgrade to Quarkus 3.33.1.1 (#627)
Upgrade to Quarkus 3.20.6.1 (#48706)
Upgrade to Quarkus 3.27.3.1 (#48690)
Upgrade to Quarkus 3.33.1.1 (keycloak#48688)