Detections
Analytics

Echo: org.bouncycastle:bc-fips: security update to 2.1.3

high Tenable Cloud Security Plugin ID 461922

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel
 platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through
 their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag
 stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from
 the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not
 provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could
 be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore
 hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20
 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation
 guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing
 rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile
 pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store.
 Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X
 FIPS series are not affected. (CVE-2026-8798)

Solution

Update the org.bouncycastle:bc-fips library and its related packages to version 2.1.3 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-8798

Plugin Details

Severity: High

ID: 461922

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-8798

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 8/8/2026

Reference Information

CVE: CVE-2026-8798