VDB

RHSA-2026:70228

RHSA-2026:70228 PUBLISHED CVSS 4.199999809265137 MEDIUM

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.

Risk Scores

CVSS 3.1
4.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected Products

VendorProductVersions
Red Hateap8-activemq-artemis-core-client-0:2.40.0-8.redhat_00024.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.40.0-8.redhat
Red Hateap8-jaxbintros-0:2.1.0-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 82.1.0-1.redhat
Red Hateap8-netty-transport-classes-epoll-0:4.1.136-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 84.1.136-1.Final
Red Hateap8-bouncycastle-0:1.85.0-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 81.85.0-1.redhat
Red Hateap8-apache-cxf-0:4.1.7-1.SP1_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 84.1.7-1.SP1
Red Hateap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 88.1.8-9.GA
Red Hateap8-activemq-artemis-hornetq-protocol-0:2.40.0-8.redhat_00024.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.40.0-8.redhat
Red Hateap8-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 82.18.9-1.redhat
Red Hateap8-slf4j-api-0:2.0.18-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.0.18-1.redhat
Red Hateap8-ironjacamar-common-spi-0:3.0.22-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 83.0.22-1.Final
Red Hateap8-hibernate-0:6.6.54-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 86.6.54-1.Final
Red Hateap8-wildfly-modules-0:8.1.8-9.GA_redhat_00006.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 88.1.8-9.GA
Red Hateap8-jackson-dataformat-yaml-0:2.18.9-1.redhat_00003.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.18.9-1.redhat
Red Hateap8-hibernate-core-0:6.6.54-1.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 86.6.54-1.Final
Red Hateap8-jaxb-xjc-0:4.0.7-4.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 84.0.7-4.redhat
Red Hateap8-activemq-artemis-server-0:2.40.0-8.redhat_00024.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.40.0-8.redhat
Red Hateap8-activemq-artemis-journal-0:2.40.0-8.redhat_00024.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.40.0-8.redhat
Red Hateap8-parsson-0:1.1.9-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 81.1.9-1.redhat
Red Hateap8-jbossws-cxf-0:7.4.0-1.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 87.4.0-1.Final
Red Hateap8-activemq-artemis-commons-0:2.40.0-8.redhat_00024.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 82.40.0-8.redhat

…and 128 more

Timeline

  • Sep 22, 2026 CVE Published
  • Oct 1, 2026 CVE Updated
  • Oct 1, 2026 Distribution Patch
  • Oct 1, 2026 Distribution Patch
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory
  • Oct 1, 2026 Security Advisory

References

…and 212 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›