In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Azul Zulu | — | Upgrade to Azul Zulu JDK 21 installer 21.51.302 (JDK 21.0.11.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.67.302 (JDK 17.0.19.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.95.0.302 (JDK 8u503-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.89.302 (JDK 11.0.31.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.35.302 (JDK 25.0.3.0.201+1, quarterly CPU) (LTS stream) | Sep 16, 2026 | Aug 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub