high
CVE-2026-71885
Bouncy Castle for Java MLS and OpenPGP signature-binding failures (MLS LeafNode credential not bound to its signature key, OpenPGP subkey and certification binding accepted without proof, truncated encrypted message accepted unverified)
- Severity
- high
- Affected product
- Bouncy Castle
- Affected versions
- Bouncy Castle ≥ 1.0, < 1.86
- Fixed in
- Bouncy Castle 1.86
- Detection basis
- Component version range
- Shipped rule
- Bouncy Castle: Bouncy Castle for Java MLS and OpenPGP signature-binding failures (MLS LeafNode credential not bound to its signature key, OpenPGP subkey and certification binding accepted without proof, truncated encrypted message accepted unverified)
- Added to NewScan
- 2026-10-03
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Bouncy Castle from its response and reports this CVE when the detected version falls inside the affected range below.
Related CVEs covered by this detection
The same shipped rule and upgrade also cover these identifiers:
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.