CVE-2026-71891

Published 3 October 2026 · tracked since 3 October 2026

Description

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field ch

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105118 MEDIUM 4.7
• CVE-2026-97873
• CVE-2026-71889
• CVE-2026-71885
• CVE-2026-71886
• CVE-2026-92767 MEDIUM 6.4
• CVE-2026-92084 CRITICAL 9.1
• CVE-2026-94505 HIGH 8.1
• CVE-2026-96267 HIGH 7.5
• CVE-2026-97343 MEDIUM 4.3

→ Open the live CVE board · all tools