CVE-2026-59650: bouncycastle: Bouncy Castle for Java: Cryptographic key compromise due to unvalidated Diffie-Hellman peer value

Severity: Critical

CVSS Score: 9.1

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.