In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its own issuing CA therefore reported isValidCertPath() true with an empty error list, while CertPathValidator.getInstance("PKIX", "BC"), which shares no code with the reviewer, rejected the identical chain against the identical trust anchor. An application using the reviewer to make the trust decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA was never authorised to issue. Both copies now check every certificate in the path including the target, waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99018 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java     applications based on the WildFly application runtime.

    This asynchronous patch is an update for Red Hat JBoss Enterprise Application     Platform 8.1. See Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * bcjmail-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement     in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)

    * bcpg-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in     CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)

    * bcutil-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement     in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)

    * bcpkix-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement     in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)

    * bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion     [eap-8.1.z] (CVE-2026-59645)

    * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z]     (CVE-2026-59645)

    * bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z]     (CVE-2026-59645)

    * bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z]     (CVE-2026-59645)

    * bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z]     (CVE-2026-59645)

    * bcprov-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement     in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)

    * bcjmail-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)

    * bcpg-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)

    * bcpkix-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)

    * bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)

    * bcjmail-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in     CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)

    * bcpg-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS     AuthenticatedData [eap-8.1.z] (CVE-2026-59642)

    * bcutil-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in     CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)

    * bcpkix-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in     CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)

    * bcprov-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in     CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)

    * bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count     [eap-8.1.z] (CVE-2026-58060)

    * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count     [eap-8.1.z] (CVE-2026-58060)

    * bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count     [eap-8.1.z] (CVE-2026-58060)

    * bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count     [eap-8.1.z] (CVE-2026-58060)

    * bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count     [eap-8.1.z] (CVE-2026-58060)

    * bcpg-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061)

    * bcprov-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z]     (CVE-2026-58061)

    * sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification [eap-8.1.z]     (CVE-2026-77185)

    * jackson-core: jackson-core: Denial of Service via excessively long JSON property names [eap-8.1.z]     (CVE-2026-68498)

    * bcutil-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks     [eap-8.1.z] (CVE-2026-71889)

    * bcjmail-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks     [eap-8.1.z] (CVE-2026-71889)

    * bcpg-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks     [eap-8.1.z] (CVE-2026-71889)

    * bcprov-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks     [eap-8.1.z] (CVE-2026-71889)

    * bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks     [eap-8.1.z] (CVE-2026-71889)

    * jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token     processing [eap-8.1.z] (CVE-2026-89425)

    * jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion     [eap-8.1.z] (CVE-2026-91777)

    * bcpg-jdk18on: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation     [eap-8.1.z] (CVE-2026-71887)

    * sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation [eap-8.1.z]     (CVE-2026-93994)

    * xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures     [eap-8.1.z] (CVE-2026-102496)

    * xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing     [eap-8.1.z] (CVE-2026-102495)

    * jackson-core: Jackson-core: Denial of Service via regular expression backtracking [eap-8.1.z]     (CVE-2026-89407)

    * neethi: Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91866)

    * neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91865)

    * neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing     [eap-8.1.z] (CVE-2026-91863)

    * neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91864)

    * wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege     escalation [eap-8.1.z] (CVE-2026-12977)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22169-1 advisory.

    Update to 1.86:

    - CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion       (bsc#1284075).
    - CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion     (bsc#1284073).
    - CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing     side-channel       attacks (bsc#1284065).
    - CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel     leaks       (bsc#1284205).
    - CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation     and group       message interception (bsc#1284165).
    - CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust     delegations and       identity spoofing (bsc#1284212).
    - CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature     misattribution and trust       context spoofing (bsc#1284213).
    - CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause     unauthenticated attribute       injection (bsc#1284215).
    - CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name     constraint bypasses       (bsc#1284218).
    - CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member     eviction and       session takeover (bsc#1284219).
    - CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature     verification bypasses       (bsc#1284220).
    - CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses     for HKDF-derived       content keys (bsc#1284221).
    - CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered     truncation errors       and integrity check bypasses (bsc#1284222).
    - CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause     resource       exhaustion (bsc#1284224).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4797-1 advisory.

    - CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion       (bsc#1284075).
    - CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion     (bsc#1284073).
    - CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing     side-channel       attacks (bsc#1284065).
    - CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel     leaks       (bsc#1284205).
    - CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation     and group       message interception (bsc#1284165).
    - CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust     delegations and       identity spoofing (bsc#1284212).
    - CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature     misattribution and trust       context spoofing (bsc#1284213).
    - CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause     unauthenticated attribute       injection (bsc#1284215).
    - CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name     constraint bypasses       (bsc#1284218).
    - CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member     eviction and       session takeover (bsc#1284219).
    - CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature     verification bypasses       (bsc#1284220).
    - CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses     for HKDF-derived       content keys (bsc#1284221).
    - CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered     truncation errors       and integrity check bypasses (bsc#1284222).
    - CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause     resource       exhaustion (bsc#1284224).

    Changes for bouncycastle:

    - Updated to version 1.86.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer -     org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy     org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate.
    checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the     CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so     the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's     subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its     own issuing CA therefore reported isValidCertPath() true with an empty error list, while     CertPathValidator.getInstance(PKIX, BC), which shares no code with the reviewer, rejected the     identical chain against the identical trust anchor. An application using the reviewer to make the trust     decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA     was never authorised to issue. Both copies now check every certificate in the path including the target,     waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip     the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for     Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also     affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X     series) and 2.1.13 (2.1.X series). (CVE-2026-71889)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379078	RHEL 10 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 8.1.9 (RHSA-2026:99018)	Nessus	Red Hat Local Security Checks	Local	high
374747	openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:22169-1)	Nessus	SuSE Local Security Checks	Local	critical
370393	SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:4797-1)	Nessus	SuSE Local Security Checks	Local	critical
362876	Linux Distros Unpatched Vulnerability : CVE-2026-71889	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-71889

high

Tenable Plugins

high

critical

critical

high