CVE-2026-13506: Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

August 3, 2026 (updated September 18, 2026)

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

References

github.com/advisories/GHSA-qp49-qgx5-5m26
github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84
github.com/bcgit/bc-java/wiki/CVE-2026-13506
nvd.nist.gov/vuln/detail/CVE-2026-13506

Code Behaviors & Features

Detect and mitigate CVE-2026-13506 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →