ALAS2023-2026-3405

References: CVE-2026-12185  CVE-2026-12802  CVE-2026-12816  CVE-2026-12860  CVE-2026-13586  CVE-2026-15055  CVE-2026-58063  CVE-2026-59647  CVE-2026-59651 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-12185)

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). (CVE-2026-12802)

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-12816)

In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-12860)

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). (CVE-2026-13586)

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). (CVE-2026-15055)

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). (CVE-2026-58063)

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). (CVE-2026-59647)

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-59651)

Issue Correction:
Run dnf update bouncycastle --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3405 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

noarch:
    bouncycastle-pkix-1.70-4.amzn2023.0.9.noarch
    bouncycastle-pg-1.70-4.amzn2023.0.9.noarch
    bouncycastle-1.70-4.amzn2023.0.9.noarch
    bouncycastle-mail-1.70-4.amzn2023.0.9.noarch
    bouncycastle-tls-1.70-4.amzn2023.0.9.noarch
    bouncycastle-javadoc-1.70-4.amzn2023.0.9.noarch
    bouncycastle-util-1.70-4.amzn2023.0.9.noarch

src:
    bouncycastle-1.70-4.amzn2023.0.9.src