# CVE-2026-13506: Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

> CVE-2026-13506 (GitHub advisory GHSA-qp49-qgx5-5m26) is a high-severity vulnerability with a CVSS 4.0 base score of 8.7, classed as Uncontrolled Recursion (CWE-674), in 4 packages, including org.bouncycastle:bcprov-jdk18on (Maven) and org.bouncycastle:bc-fips (Maven). Fixed versions: org.bouncycastle:bcprov-jdk18on 1.85; org.bouncycastle:bc-fips 1.0.2.7, 2.0.2 or 2.1.3; and 2 more packages.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-13506

| Field | Value |
| --- | --- |
| CVE | CVE-2026-13506 |
| GHSA | GHSA-qp49-qgx5-5m26 |
| Severity | High |
| CVSS 4.0 | 8.7 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber` (GitHub Advisory Database) |
| CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) |
| CWE | CWE-674 Uncontrolled Recursion |
| EPSS | 0.44% (higher than 35% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact partial |
| Published | 3 Aug 2026 |
| Modified | 18 Sept 2026 |

## Description

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.bouncycastle:bcprov-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk18on` | < 1.85 | 1.85 |
| org.bouncycastle:bc-fips | Maven | `pkg:maven/org.bouncycastle/bc-fips` | < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 | 1.0.2.7, 2.0.2, 2.1.3 |
| org.bouncycastle:bcprov-lts8on | Maven | `pkg:maven/org.bouncycastle/bcprov-lts8on` | < 2.73.12 | 2.73.12 |
| org.bouncycastle:bcprov-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15to18` | < 1.85 | 1.85 |

## Fix commits

- Patch: https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84
- Release: https://github.com/bcgit/bc-java/commit/57fbd3c501f7a369f64eda311d6a709fc0bcae84 (1.85)

## Questions

**What is the GHSA ID for CVE-2026-13506?**

GitHub tracks CVE-2026-13506 as GHSA-qp49-qgx5-5m26.

**What is the CVSS score of CVE-2026-13506?**

CVE-2026-13506 has a CVSS 4.0 base score of 8.7 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber. Other published scores: CVSS 3.1 7.5.

**Which versions are affected by CVE-2026-13506?**

org.bouncycastle:bcprov-jdk18on (Maven): < 1.85. org.bouncycastle:bc-fips (Maven): < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3. org.bouncycastle:bcprov-lts8on (Maven): < 2.73.12. org.bouncycastle:bcprov-jdk15to18 (Maven): < 1.85.

**How do I fix CVE-2026-13506?**

Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk18on 1.85; org.bouncycastle:bc-fips 1.0.2.7, 2.0.2 or 2.1.3; org.bouncycastle:bcprov-lts8on 2.73.12; org.bouncycastle:bcprov-jdk15to18 1.85. The fix is in commit 77454da.

**What is the Package URL (PURL) for CVE-2026-13506?**

The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bc-fips, pkg:maven/org.bouncycastle/bcprov-lts8on and pkg:maven/org.bouncycastle/bcprov-jdk15to18.

**Is CVE-2026-13506 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-13506. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 35% of CVEs.

## References

- https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84 (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2026-13506 (advisory)
- https://github.com/bcgit/bc-java/wiki/CVE-2026-13506 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13506.json (advisory)
- https://github.com/advisories/GHSA-qp49-qgx5-5m26 (advisory)
- https://github.com/bcgit/bc-java (package)
- https://github.com/bcgit/bc-lts-java (package)
- https://www.bouncycastle.org/download/bouncy-castle-java-fips/
- https://www.bouncycastle.org/download/bouncy-castle-java-lts/
- https://www.bouncycastle.org/download/bouncy-castle-java/

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-13506), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.