CVE-2026-5598 has incorrect fixed versions for bcprov-jdk packages

Open Beginner friendly

#8,994 opened on Aug 5, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 72/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Quiet
Tech stack: java
Domain: security

Research direction

Start by comparing the CVE-2026-5598 advisory with the Bouncy Castle wiki and the versions available on Maven. Update the affected and patched version ranges for org.bouncycastle:bcprov-jdk14, bcprov-jdk15to18, and bcprov-jdk18on, then verify that all listed versions match those sources.

Written by the indexing model from the issue text.

Description

CVE-2026-5598
The affected and fixed versions listed for org.bouncycastle:bcprov-jdk are incorrect.
According to https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598 and the versions available on Maven. The following are the expected affected versions and fixed versions.

Package
org.bouncycastle:bcprov-jdk14
Affected versions

= 1.71, < 1.84
Patched versions
1.84

org.bouncycastle:bcprov-jdk15to18
Affected versions

= 1.71, < 1.84
Patched versions
1.84

org.bouncycastle:bcprov-jdk18on
Affected versions

= 1.71 < 1.80.2, 1.81.0, <= 1.82 < 1.84
Patched versions
1.80.2, 1.81.1, 1.84

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 18h
Merged PRs (30d): 48

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

databricks/databricks-sql-nodejs#526 · Opened Sep 22, 2026
pii_scan gate does not block on its two critical rules: an SSN or credit-card number passes Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

sipyourdrink-ltd/bernstein#6191 · Opened Sep 22, 2026
injector: non-canonical loopback spellings bypass echo detection Open

security severity:low track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ntindle/spark-vm#259 · Opened Sep 22, 2026
[addtool] DeepZero Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

gwen001/offsectools_www#2055 · Opened Sep 22, 2026
claude auto-review custom_prompt executes shell substitutions Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

WalletConnect/actions#112 · Opened Sep 22, 2026

More Security issues