In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Azul Zulu | — | Upgrade to Azul Zulu JDK 17 installer 17.67.302 (JDK 17.0.19.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.35.302 (JDK 25.0.3.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.89.302 (JDK 11.0.31.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.51.302 (JDK 21.0.11.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.95.0.302 (JDK 8u503-b01, quarterly CPU) (LTS stream) | Sep 16, 2026 | Aug 3, 2026 |
| Redhat_linux | — | — | Aug 19, 2026 | Aug 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub