{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58061.json"
      }
    ],
    "title": "org.bouncycastle/bc-java: org.bouncycastle/bc-fja: Bouncy Castle for Java: Integrity bypass in CCM-family modes",
    "tracking": {
      "current_release_date": "2026-09-09T11:34:44+00:00",
      "generator": {
        "date": "2026-09-09T11:34:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.17"
        }
      },
      "id": "CVE-2026-58061",
      "initial_release_date": "2026-08-03T02:36:36.753000+00:00",
      "revision_history": [
        {
          "date": "2026-08-03T02:36:36.753000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-09T11:14:33+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-09-09T11:34:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 8",
                "product": {
                  "name": "Red Hat Enterprise Linux 8",
                  "product_id": "red_hat_enterprise_linux_8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 8"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 9",
                "product": {
                  "name": "Red Hat Enterprise Linux 9",
                  "product_id": "red_hat_enterprise_linux_9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 9"
          },
          {
            "category": "product_version",
            "name": "resteasy.src::pki-core:10.6",
            "product": {
              "name": "resteasy.src (pki-core:10.6)",
              "product_id": "resteasy.src::pki-core:10.6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/resteasy?arch=src&rpmmod=pki-core:10.6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "resteasy-javadoc::pki-core:10.6",
            "product": {
              "name": "resteasy-javadoc (pki-core:10.6)",
              "product_id": "resteasy-javadoc::pki-core:10.6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/resteasy-javadoc?rpmmod=pki-core:10.6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "resteasy::pki-core:10.6",
            "product": {
              "name": "resteasy (pki-core:10.6)",
              "product_id": "resteasy::pki-core:10.6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/resteasy?rpmmod=pki-core:10.6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "resteasy.src::pki-deps:10.6",
            "product": {
              "name": "resteasy.src (pki-deps:10.6)",
              "product_id": "resteasy.src::pki-deps:10.6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/resteasy?arch=src&rpmmod=pki-deps:10.6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "resteasy-javadoc::pki-deps:10.6",
            "product": {
              "name": "resteasy-javadoc (pki-deps:10.6)",
              "product_id": "resteasy-javadoc::pki-deps:10.6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/resteasy-javadoc?rpmmod=pki-deps:10.6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "resteasy::pki-deps:10.6",
            "product": {
              "name": "resteasy (pki-deps:10.6)",
              "product_id": "resteasy::pki-deps:10.6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/resteasy?rpmmod=pki-deps:10.6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "jmc.src",
            "product": {
              "name": "jmc.src",
              "product_id": "jmc.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/jmc?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "jmc",
            "product": {
              "name": "jmc",
              "product_id": "jmc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/jmc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pki-resteasy",
            "product": {
              "name": "pki-resteasy",
              "product_id": "pki-resteasy",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pki-resteasy"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pki-resteasy-core",
            "product": {
              "name": "pki-resteasy-core",
              "product_id": "pki-resteasy-core",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pki-resteasy-core"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pki-resteasy-jackson2-provider",
            "product": {
              "name": "pki-resteasy-jackson2-provider",
              "product_id": "pki-resteasy-jackson2-provider",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pki-resteasy-jackson2-provider"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pki-resteasy-client",
            "product": {
              "name": "pki-resteasy-client",
              "product_id": "pki-resteasy-client",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pki-resteasy-client"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pki-resteasy-servlet-initializer",
            "product": {
              "name": "pki-resteasy-servlet-initializer",
              "product_id": "pki-resteasy-servlet-initializer",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pki-resteasy-servlet-initializer"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "resteasy-javadoc (pki-core:10.6) as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:resteasy-javadoc::pki-core:10.6"
        },
        "product_reference": "resteasy-javadoc::pki-core:10.6",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "resteasy-javadoc (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:resteasy-javadoc::pki-deps:10.6"
        },
        "product_reference": "resteasy-javadoc::pki-deps:10.6",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "resteasy.src (pki-core:10.6) as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:resteasy.src::pki-core:10.6"
        },
        "product_reference": "resteasy.src::pki-core:10.6",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "resteasy.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:resteasy.src::pki-deps:10.6"
        },
        "product_reference": "resteasy.src::pki-deps:10.6",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "resteasy (pki-core:10.6) as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:resteasy::pki-core:10.6"
        },
        "product_reference": "resteasy::pki-core:10.6",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "resteasy (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:resteasy::pki-deps:10.6"
        },
        "product_reference": "resteasy::pki-deps:10.6",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jmc as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:jmc"
        },
        "product_reference": "jmc",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jmc.src as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:jmc.src"
        },
        "product_reference": "jmc.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-resteasy as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:pki-resteasy"
        },
        "product_reference": "pki-resteasy",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-resteasy-client as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:pki-resteasy-client"
        },
        "product_reference": "pki-resteasy-client",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-resteasy-core as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:pki-resteasy-core"
        },
        "product_reference": "pki-resteasy-core",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-resteasy-jackson2-provider as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:pki-resteasy-jackson2-provider"
        },
        "product_reference": "pki-resteasy-jackson2-provider",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pki-resteasy-servlet-initializer as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:pki-resteasy-servlet-initializer"
        },
        "product_reference": "pki-resteasy-servlet-initializer",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-58061",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-08-03T03:01:25.268381+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_enterprise_linux_8:resteasy-javadoc::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy-javadoc::pki-deps:10.6",
            "red_hat_enterprise_linux_8:resteasy.src::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy.src::pki-deps:10.6",
            "red_hat_enterprise_linux_8:resteasy::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy::pki-deps:10.6",
            "red_hat_enterprise_linux_9:jmc",
            "red_hat_enterprise_linux_9:jmc.src",
            "red_hat_enterprise_linux_9:pki-resteasy",
            "red_hat_enterprise_linux_9:pki-resteasy-client",
            "red_hat_enterprise_linux_9:pki-resteasy-core",
            "red_hat_enterprise_linux_9:pki-resteasy-jackson2-provider",
            "red_hat_enterprise_linux_9:pki-resteasy-servlet-initializer"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510224"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. When using CCM-family (Counter with CBC-MAC) modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity impact if the plaintext is processed before the tag validation completes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bc-java: org.bouncycastle/bc-fja: Bouncy Castle for Java: Integrity bypass in CCM-family modes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has an Important impact. Bouncy Castle for Java's CCM-family authenticated encryption modes (Counter with CBC-MAC) write decrypted plaintext to the caller's buffer before verifying the cryptographic tag. A remote attacker can exploit this by sending manipulated ciphertext, which will be decrypted and written to the buffer. If the application processes this buffer before the tag verification completes and fails, the attacker has successfully bypassed the integrity protection, allowing manipulation of data that the application assumes is authenticated. This affects applications using CCMBlockCipher, KCCMBlockCipher, or KGCMBlockCipher modes from the Bouncy Castle crypto provider.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_enterprise_linux_8:resteasy-javadoc::pki-core:10.6",
          "red_hat_enterprise_linux_8:resteasy-javadoc::pki-deps:10.6",
          "red_hat_enterprise_linux_8:resteasy.src::pki-core:10.6",
          "red_hat_enterprise_linux_8:resteasy.src::pki-deps:10.6",
          "red_hat_enterprise_linux_8:resteasy::pki-core:10.6",
          "red_hat_enterprise_linux_8:resteasy::pki-deps:10.6",
          "red_hat_enterprise_linux_9:jmc",
          "red_hat_enterprise_linux_9:jmc.src",
          "red_hat_enterprise_linux_9:pki-resteasy",
          "red_hat_enterprise_linux_9:pki-resteasy-client",
          "red_hat_enterprise_linux_9:pki-resteasy-core",
          "red_hat_enterprise_linux_9:pki-resteasy-jackson2-provider",
          "red_hat_enterprise_linux_9:pki-resteasy-servlet-initializer"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58061"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510224",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510224"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58061",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58061"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58061",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58061"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/08d675106bb663ddcc6ec0a4af6f6f62f512697b",
          "url": "https://github.com/bcgit/bc-java/commit/08d675106bb663ddcc6ec0a4af6f6f62f512697b"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/cd4a5ab3ad619ff03c7767c1b8b19d5dea2970af",
          "url": "https://github.com/bcgit/bc-java/commit/cd4a5ab3ad619ff03c7767c1b8b19d5dea2970af"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58061",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58061"
        }
      ],
      "release_date": "2026-08-03T02:36:36.753000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_enterprise_linux_8:resteasy-javadoc::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy-javadoc::pki-deps:10.6",
            "red_hat_enterprise_linux_8:resteasy.src::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy.src::pki-deps:10.6",
            "red_hat_enterprise_linux_8:resteasy::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy::pki-deps:10.6",
            "red_hat_enterprise_linux_9:jmc",
            "red_hat_enterprise_linux_9:jmc.src",
            "red_hat_enterprise_linux_9:pki-resteasy",
            "red_hat_enterprise_linux_9:pki-resteasy-client",
            "red_hat_enterprise_linux_9:pki-resteasy-core",
            "red_hat_enterprise_linux_9:pki-resteasy-jackson2-provider",
            "red_hat_enterprise_linux_9:pki-resteasy-servlet-initializer"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "red_hat_enterprise_linux_8:resteasy-javadoc::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy-javadoc::pki-deps:10.6",
            "red_hat_enterprise_linux_8:resteasy.src::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy.src::pki-deps:10.6",
            "red_hat_enterprise_linux_8:resteasy::pki-core:10.6",
            "red_hat_enterprise_linux_8:resteasy::pki-deps:10.6",
            "red_hat_enterprise_linux_9:jmc",
            "red_hat_enterprise_linux_9:jmc.src",
            "red_hat_enterprise_linux_9:pki-resteasy",
            "red_hat_enterprise_linux_9:pki-resteasy-client",
            "red_hat_enterprise_linux_9:pki-resteasy-core",
            "red_hat_enterprise_linux_9:pki-resteasy-jackson2-provider",
            "red_hat_enterprise_linux_9:pki-resteasy-servlet-initializer"
          ]
        }
      ],
      "title": "org.bouncycastle/bc-java: org.bouncycastle/bc-fja: Bouncy Castle for Java: Integrity bypass in CCM-family modes"
    }
  ]
}